{"id":"CVE-2026-85108","kind":"vulnerability","aliases":["CVE-2026-85108"],"related":[],"title":"Apache Mime4J: unbounded resource use lets crafted emails crash parsers","description":"Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.\nUsers are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults.","summary":"Apache James Mime4J is a Java library for parsing MIME email messages. Versions before 0.8.15 allocate resources without limits while parsing, so a crafted message can cause a denial of service.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-parsing","java","mime4j","package"],"not_affected_if":["no-untrusted-mime-input"],"how_to_check":"- Find the Mime4J version in your dependencies, for example `mvn dependency:tree` or `gradle dependencies` filtered for `apache-mime4j`\n- Flag any version below `0.8.15` as affected","fix":null,"status":"open","published_at":"2026-11-06T12:17:23+00:00","first_seen_at":"2026-11-06T12:41:49+00:00","triaged_at":"2026-11-06T12:42:56+00:00","updated_at":"2026-11-06T12:42:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T12:42:56Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Mime4J: upgrade to `0.8.15`, which enforces new limits and better defaults","reach":"network","title":"Apache Mime4J: unbounded resource use lets crafted emails crash parsers","impact":"low","summary":"Apache James Mime4J is a Java library for parsing MIME email messages. Versions before 0.8.15 allocate resources without limits while parsing, so a crafted message can cause a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","mime4j","email-parsing"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"crafted email exhausts memory or CPU, service becomes unavailable","analyst_note":"","how_to_check":"- Find the Mime4J version in your dependencies, for example `mvn dependency:tree` or `gradle dependencies` filtered for `apache-mime4j`\n- Flag any version below `0.8.15` as affected","plain_action":"","needs_analyst":false,"not_affected_if":["no-untrusted-mime-input"],"who_is_affected":"Any Java application that parses MIME messages with Mime4J before 0.8.15 is exposed, including mail processing services that accept untrusted email. Applications that do not parse untrusted MIME input can skip it. The sources do not say which default limits were changed or whether a configuration override is needed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000682,"input_tokens":4224,"output_tokens":519,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-85108':13A,16A '0.8.15':37B,68C,84C 'alloc':38B,54C 'allow':69C 'apach':1A,23B,62C 'better':95C 'caus':49B 'craft':7A,46B 'crash':9A 'cve':11A,14A 'default':96C 'denial':51B,70C 'email':8A,18B,33B 'email-pars':17B 'enforc':90C 'fix':86C 'issu':88C 'jame':24B,63C 'java':20B,28B 'let':6A 'librari':29B,65C 'limit':41B,58C,92C 'messag':34B,47B,76C 'mime':32B,75C 'mime4j':2A,21B,25B,64C 'new':91C 'packag':22B 'pars':19B,31B,43B,74C 'parser':10A 'prior':66C 'provid':94C 'recommend':79C 'resourc':4A,39B,56C 'servic':53B,72C 'throttl':60C 'unbound':3A 'upgrad':81C 'upon':73C 'use':5A 'user':77C 'version':35B,67C,83C 'without':40B,57C","nicknames":[],"mitigations":[],"who_affected":"Any Java application that parses MIME messages with Mime4J before 0.8.15 is exposed, including mail processing services that accept untrusted email. Applications that do not parse untrusted MIME input can skip it. The sources do not say which default limits were changed or whether a configuration override is needed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["emailparsing","java","mime4j","package","unknown"],"campaign_type":null,"search_a":"'-2026':12A,15A '-85108':13A,16A 'apach':1A 'craft':7A 'crash':9A 'cve':11A,14A 'email':8A 'let':6A 'mime4j':2A 'parser':10A 'resourc':4A 'unbound':3A 'use':5A","search_b":"'0.8.15':37B 'alloc':38B 'apach':23B 'caus':49B 'craft':46B 'denial':51B 'email':18B,33B 'email-pars':17B 'jame':24B 'java':20B,28B 'librari':29B 'limit':41B 'messag':34B,47B 'mime':32B 'mime4j':21B,25B 'packag':22B 'pars':19B,31B,43B 'resourc':39B 'servic':53B 'version':35B 'without':40B","search_c":"'0.8.15':68C,84C 'alloc':54C 'allow':69C 'apach':62C 'better':95C 'default':96C 'denial':70C 'enforc':90C 'fix':86C 'issu':88C 'jame':63C 'librari':65C 'limit':58C,92C 'messag':76C 'mime':75C 'mime4j':64C 'new':91C 'pars':74C 'prior':66C 'provid':94C 'recommend':79C 'resourc':56C 'servic':72C 'throttl':60C 'upgrad':81C 'upon':73C 'user':77C 'version':67C,83C 'without':57C","first_public_at":"2026-11-06T12:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85108","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85108","severity":null,"published_at":"2026-11-06T12:17:23+00:00","modified_at":"2026-11-06T12:17:23+00:00","first_seen_at":"2026-11-06T12:41:49+00:00","fetched_at":"2026-11-06T12:41:49+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}