CVE-2026-85111 · Package
NO FIX YET · SEE WHAT TO DO
Apache James Mime4J, a Java library for parsing email MIME messages, allocates resources without limits or throttling before 0.8.15. An attacker who sends a crafted message can make the parsing code consume enough resources to deny service.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any Java application that parses MIME messages with Mime4J before 0.8.15 is exposed, including mail processing code and the Apache James server itself. Systems that do not parse untrusted MIME input with this library, or that already run 0.8.15 or later, can skip it. The sources do not describe the exact input shape that triggers the excess allocation.
Not affected if fixed-version, no-mime-parsing
Who cares apache-james, email-parsing, java, mime4j
mvn dependency:tree or gradle dependencies, looking for apache-mime4j or org.apache.james:apache-mime4j below 0.8.153.9.1 as the fixed buildAllocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue.
See CVE-2026-85108 in Apache James MIME4J library.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
0.8.153.9.1, which relies on the fixed Mime4J 0.8.15