CVE-2026-85111: Apache James: Denial of service upon MIME parsing

Summary by Cyber Security News6 Nov 2026, 18:03 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/553

Posted by Benoit Tellier on Nov 06 Severity: CVSS 4.0: 8.7 (high) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected versions: - Apache James before 3.9.1 Description: Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

InfiniteWP Client: the NOSSL signing key has 31 bits of secret — recovered live in 291.9 seconds

CVE-2026-123779: Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes

CVE-2026-120832: Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution

CVE-2026-120367: Apache Axis2/Java: unbounded JSON request body buffering

CVE-2026-123770: Apache Axis2/Java: Unbounded multipart and form-encoded request bodies

CVE-2026-123766: Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page