CVE-2026-85111High· 8.7▾ TwilightAllocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to Apache James server 3.9.1 that relies on fi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue.
See CVE-2026-85108 in Apache James MIME4J library.
apache_james < 3.9.1org.apache.james:james-server < 3.9.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-74756NoneApache James: WebAdmin exposed without authentication on official Docker default
CVE-2026-76168NoneApache James: ManageSieve file implementation cross-user path traversal
CVE-2026-49939NoneApache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
CVE-2025-66621NoneApache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
CVE-2026-76171NoneApache James: SSRF filter bypass in the JMAP PushSubscription web-push client
CVE-2026-100302High· 7.1Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling