CVE-2026-85108 · Package
NO FIX YET
Apache James Mime4J is a Java library for parsing MIME email messages. Versions before 0.8.15 allocate resources without limits while parsing, so a crafted message can cause a denial of service.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any Java application that parses MIME messages with Mime4J before 0.8.15 is exposed, including mail processing services that accept untrusted email. Applications that do not parse untrusted MIME input can skip it. The sources do not say which default limits were changed or whether a configuration override is needed.
Not affected if no-untrusted-mime-input
Who cares email-parsing, java, mime4j
mvn dependency:tree or gradle dependencies filtered for apache-mime4j0.8.15 as affectedUnknown from the sources.
Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.