https://seclists.org/oss-sec/2026/q4/553: CVE-2026-85111: Apache James: Denial of service upon MIME parsing
Published Nov 6, 2026
·Updated
Affected Software
2 affected components
Apache James<3.9.1
Apache Mime4J<0.8.15
The CVSS vector indicates the issue can be exploited remotely with low attack complexity, without authentication or user interaction. An attacker needs to cause Apache James to parse a crafted MIME message.
Apache James versions before 3.9.1 are affected. The underlying issue is in Mime4J versions before 0.8.15.
Successful exploitation can cause a denial of service through unbounded or insufficiently throttled resource allocation while parsing MIME messages. The supplied CVSS vector rates availability impact as high and does not indicate confidentiality or integrity impact.
Upgrade Apache James Server to version 3.9.1, which uses the fixed Mime4J 0.8.15 release.