Apache James MIME4J DoS Vulnerability Fixed
What's new
First merged summary.
Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI
Upgrade to Mime4J 0.8.15 or Apache James 3.9.1 fixes MIME parsing denial of service
Apache James MIME4J library suffers from allocation of resources without limits or throttling, enabling denial of service when parsing MIME messages. The issue affects Mime4J Core and Dom before version 0.8.15 and Apache James before 3.9.1. Upgrades to the fixed versions resolve the problem. The vulnerability was disclosed on oss-security.
Key facts
- Mime4J Core and Dom before 0.8.15 affected
- Apache James before 3.9.1 affected
- Fixed in Mime4J 0.8.15
- Fixed in Apache James 3.9.1
- CVE-2026-85108 and CVE-2026-85111
- DoS from unlimited resource allocation
Timeline
dated events in the reporting · oldest first- Nov 6, 2026oss-security discloses CVE-2026-85108 for Apache James MIME4J · oss-security
- Nov 6, 2026oss-security discloses CVE-2026-85111 for Apache James · oss-security
What each outlet adds
beyond the shared facts- oss-securityCVE-2026-85108 for Mime4J library
- oss-securityCVE-2026-85111 for Apache James product
- Vendors
- Apache
Coverage
oldest first · one row per article · UTC- · 5d ago
oss-securityFirst report
Apache James Mime4J before 0.8.15 allows denial of service upon MIME parsing
Upgrade to Mime4J 0.8.15 fixes the denial of service issue in Apache James
- · 5d ago
Apache James before 3.9.1 allows denial of service upon MIME parsing
Upgrade to Apache James 3.9.1 or Mime4J 0.8.15 fixes the MIME parsing denial of service issue
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85108 | Denial of Service in Apache James Mime4J before 0.8.15 | 7.5 | — | ||
| CVE-2026-85111 | Resource Exhaustion DoS in Apache James Mime4J library before 0.8.15 | 8.7 | — |