---
id: "CVE-2026-85108"
page: "https://infrastack.ai/live/CVE-2026-85108"
kind: "vulnerability"
aliases: ["CVE-2026-85108"]
title: "Apache Mime4J: unbounded resource use lets crafted emails crash parsers"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["email-parsing", "java", "mime4j", "package"]
not_affected_if: ["no-untrusted-mime-input"]
published_at: "2026-11-06T12:17:23+00:00"
first_seen_at: "2026-11-06T12:41:49+00:00"
updated_at: "2026-11-06T12:42:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85108", "first_seen_at": "2026-11-06T12:41:49+00:00"}]
exploit_sources: []
---

# Apache Mime4J: unbounded resource use lets crafted emails crash parsers

Link for people: https://infrastack.ai/live/CVE-2026-85108 (this .md is for agents)

Apache James Mime4J is a Java library for parsing MIME email messages. Versions before 0.8.15 allocate resources without limits while parsing, so a crafted message can cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find the Mime4J version in your dependencies, for example `mvn dependency:tree` or `gradle dependencies` filtered for `apache-mime4j`
- Flag any version below `0.8.15` as affected

## Timeline

- 2026-11-06T12:41:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85108

## From the sources

Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.
Users are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_