{"id":"CVE-2026-76171","kind":"vulnerability","aliases":["CVE-2026-76171"],"related":[],"title":"Apache James: JMAP web push validation lets requests reach internal addresses","description":"In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses.\nUsers are recommended to upgrade to version 3.9.1 which fixes this issue.","summary":"Apache James mail server before 3.9.1 fails to properly validate URLs in its JMAP web push feature. An attacker can make the server send requests to internal network addresses that should be unreachable from outside.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-james","jmap","mail-server","runtime","self-hosted"],"not_affected_if":["version-3.9.1-or-later"],"how_to_check":"- Check the installed Apache James version and see whether it is below `3.9.1`\n- Confirm whether JMAP web push is enabled in the deployment configuration","fix":"- Apache James: upgrade to `3.9.1`","status":"open","published_at":"2026-11-06T12:17:21+00:00","first_seen_at":"2026-11-06T12:41:49+00:00","triaged_at":"2026-11-06T12:42:56+00:00","updated_at":"2026-11-06T12:42:56+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-06T12:42:56Z","model":"claude-haiku-5-5","output":{"fix":"- Apache James: upgrade to `3.9.1`","reach":"internet","title":"Apache James: JMAP web push validation lets requests reach internal addresses","impact":"medium","summary":"Apache James mail server before 3.9.1 fails to properly validate URLs in its JMAP web push feature. An attacker can make the server send requests to internal network addresses that should be unreachable from outside.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-james","mail-server","jmap","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Server-side requests reach internal addresses that are normally blocked","analyst_note":"","how_to_check":"- Check the installed Apache James version and see whether it is below `3.9.1`\n- Confirm whether JMAP web push is enabled in the deployment configuration","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.9.1-or-later"],"who_is_affected":"Teams running Apache James server before 3.9.1 with the JMAP web push feature in use are exposed, since that is where the SSRF validation flaw sits. Deployments on 3.9.1 or later are not affected. The sources do not say whether web push is enabled by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000661,"input_tokens":4200,"output_tokens":483,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-76171':14A,17A '3.9.1':34B,70C,94C 'address':11A,57B,86C 'apach':1A,19B,29B,65C 'apache-jam':18B 'attack':47B 'cve':12A,15A 'fail':35B 'featur':45B 'fix':96C 'host':28B 'improp':71C 'intern':10A,55B,85C 'issu':98C 'jame':2A,20B,30B,66C 'jmap':3A,21B,42B,74C 'lead':79C 'let':7A 'mail':23B,31B 'mail-serv':22B 'make':49B 'network':56B 'outsid':63B 'possibl':82C 'prior':68C 'proper':37B 'push':5A,44B 'reach':9A,84C 'recommend':89C 'request':8A,53B 'runtim':25B 'self':27B 'self-host':26B 'send':52B 'server':24B,32B,51B,67C 'ssrf':76C 'unreach':61B 'upgrad':91C 'url':39B 'user':87C 'valid':6A,38B,72C,77C 'version':69C,93C 'web':4A,43B 'webpush':75C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache James server before 3.9.1 with the JMAP web push feature in use are exposed, since that is where the SSRF validation flaw sits. Deployments on 3.9.1 or later are not affected. The sources do not say whether web push is enabled by default.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachejames","jmap","mailserver","medium","runtime","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-76171':14A,17A 'address':11A 'apach':1A 'cve':12A,15A 'intern':10A 'jame':2A 'jmap':3A 'let':7A 'push':5A 'reach':9A 'request':8A 'valid':6A 'web':4A","search_b":"'3.9.1':34B 'address':57B 'apach':19B,29B 'apache-jam':18B 'attack':47B 'fail':35B 'featur':45B 'host':28B 'intern':55B 'jame':20B,30B 'jmap':21B,42B 'mail':23B,31B 'mail-serv':22B 'make':49B 'network':56B 'outsid':63B 'proper':37B 'push':44B 'request':53B 'runtim':25B 'self':27B 'self-host':26B 'send':52B 'server':24B,32B,51B 'unreach':61B 'url':39B 'valid':38B 'web':43B","search_c":"'3.9.1':70C,94C 'address':86C 'apach':65C 'fix':96C 'improp':71C 'intern':85C 'issu':98C 'jame':66C 'jmap':74C 'lead':79C 'possibl':82C 'prior':68C 'reach':84C 'recommend':89C 'server':67C 'ssrf':76C 'upgrad':91C 'user':87C 'valid':72C,77C 'version':69C,93C 'webpush':75C","first_public_at":"2026-11-06T12:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76171","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76171","severity":null,"published_at":"2026-11-06T12:17:21+00:00","modified_at":"2026-11-06T12:17:21+00:00","first_seen_at":"2026-11-06T12:41:49+00:00","fetched_at":"2026-11-06T12:41:49+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}