---
id: CVE-2026-85111
title: 'Apache James: Denial of service upon MIME parsing'
summary: >-
  Allocation of Resources Without Limits or Throttling in Apache James Mime4J
  library prior version 0.8.15 allows Denial of Service upon parsing Mime
  messages.

  Users are recommended to upgrade to Apache James server 3.9.1 that relies on
  fi…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-770
vendor: Apache Software Foundation
product: Apache James
affected:
  - apache_james < 3.9.1
  - 'org.apache.james:james-server < 3.9.1'
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T11:50:40.472Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-85111'
references:
  - url: 'https://lists.apache.org/thread.html/j1bql696qvg935lp8zo0m626jp9n0h8q'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-85108'
tags:
  - cve.org
ingestedAt: '2026-11-06T12:51:23.200Z'
---

## Overview

Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.
Users are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue.

See CVE-2026-85108 in Apache James MIME4J library.

## Affected

- `apache_james < 3.9.1`
- `org.apache.james:james-server < 3.9.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.