high · CVSS v3 7.5 · CVSS v4 8.7
CVE-2026-85111
Apache James Mime4J library before 0.8.15 can allocate unlimited resources when parsing MIME messages, leading to denial of service. This af
Overview
Apache James Mime4J library before 0.8.15 can allocate unlimited resources when parsing MIME messages, leading to denial of service. This affects any system using the library to process email or MIME content. The issue is mitigated by upgrading to the patched version.
Description
Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue. See CVE-2026-85108 in Apache James MIME4J library.
Impact
The vulnerability can cause a denial of service, impacting availability of mail services and potentially allowing attackers to exhaust server resources. Defenders should monitor for high CPU/memory usage during email processing.
Remediation
Upgrade to Apache James Server 3.9.1 or later, which includes Mime4J 0.8.15. If upgrade not possible, restrict MIME parsing to trusted sources or limit resource usage via system limits or container quotas.
Risk context
High severity CVSS v3 7.5 and v4 8.7 indicate significant risk. Defenders should address promptly.
Affected products
- Apache James
- Apache James Mime4J
- Apache James Server
- Mail servers using Mime4J
Scores
- Severity
- high
- CVSS v2
- 5
- CVSS v3
- 7.5
- CVSS v4
- 8.7
- EPSS
- —