Apache James SSRF filter bypass in JMAP web-push client
Apache James server allows bypass of the SSRF filter in its JMAP PushSubscription web-push client.
30
CVE-2026-76171
SSRF bypass in Apache James JMAP webPush before 3.9.1
- CVSS 3.1
- 9.1 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Improper validation in JMAP webPush SSRF check in Apache James server allows reaching internal addresses. This affects Apache James users running versions prior to 3.9.1 who enable the JMAP web-push client. Attackers can target internal network addresses via the web-push feature.
What to do: Upgrade to Apache James 3.9.1
| Product | Affected | Fixed in |
|---|---|---|
| Apache James | < 3.9.1 | 3.9.1 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses. Users are recommended to upgrade to version 3.9.1 which fixes this issue.
- Weakness
- CWE-918
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N