{"id":"CVE-2026-85111","kind":"vulnerability","aliases":["CVE-2026-85111"],"related":[],"title":"Apache James Mime4J: unbounded resource use lets MIME parsing cause denial of service","description":"Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.\nUsers are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue.\n\nSee CVE-2026-85108 in Apache James MIME4J library.","summary":"Apache James Mime4J, a Java library for parsing email MIME messages, allocates resources without limits or throttling before 0.8.15. An attacker who sends a crafted message can make the parsing code consume enough resources to deny service.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-james","email-parsing","java","mime4j","package"],"not_affected_if":["fixed-version","no-mime-parsing"],"how_to_check":"- Check the Mime4J version in your dependency tree, for example `mvn dependency:tree` or `gradle dependencies`, looking for `apache-mime4j` or `org.apache.james:apache-mime4j` below `0.8.15`\n- Check whether the Apache James server is in use and which version runs, since the sources point to James server `3.9.1` as the fixed build","fix":"- Apache James Mime4J library: upgrade to `0.8.15` or later\n- Apache James server: upgrade to `3.9.1`, which relies on the fixed Mime4J `0.8.15`","status":"open","published_at":"2026-11-06T12:17:23+00:00","first_seen_at":"2026-11-06T12:41:49+00:00","triaged_at":"2026-11-06T12:42:39+00:00","updated_at":"2026-11-06T12:42:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T12:42:39Z","model":"claude-haiku-5-5","output":{"fix":"- Apache James Mime4J library: upgrade to `0.8.15` or later\n- Apache James server: upgrade to `3.9.1`, which relies on the fixed Mime4J `0.8.15`","reach":"unknown","title":"Apache James Mime4J: unbounded resource use lets MIME parsing cause denial of service","impact":"low","summary":"Apache James Mime4J, a Java library for parsing email MIME messages, allocates resources without limits or throttling before 0.8.15. An attacker who sends a crafted message can make the parsing code consume enough resources to deny service.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","mime4j","apache-james","email-parsing"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Parsing service becomes unavailable through resource exhaustion","analyst_note":"Confirm the trigger input and whether the network reach is remote; the sources do not say, and a related CVE-2026-85108 is referenced.","how_to_check":"- Check the Mime4J version in your dependency tree, for example `mvn dependency:tree` or `gradle dependencies`, looking for `apache-mime4j` or `org.apache.james:apache-mime4j` below `0.8.15`\n- Check whether the Apache James server is in use and which version runs, since the sources point to James server `3.9.1` as the fixed build","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","no-mime-parsing"],"who_is_affected":"Any Java application that parses MIME messages with Mime4J before 0.8.15 is exposed, including mail processing code and the Apache James server itself. Systems that do not parse untrusted MIME input with this library, or that already run 0.8.15 or later, can skip it. The sources do not describe the exact input shape that triggers the excess allocation.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00077,"input_tokens":4263,"output_tokens":688,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A,111C '-85108':112C '-85111':16A,19A '0.8.15':47B,80C,104C '3.9.1':98C 'address':106C 'alloc':40B,66C 'allow':81C 'apach':1A,21B,29B,74C,95C,114C 'apache-jam':20B 'attack':49B 'caus':10A 'code':59B 'consum':60B 'craft':53B 'cve':14A,17A,110C 'deni':64B 'denial':11A,82C 'email':24B,37B 'email-pars':23B 'enough':61B 'fix':102C 'issu':108C 'jame':2A,22B,30B,75C,96C,115C 'java':26B,33B 'let':7A 'librari':34B,77C,117C 'limit':43B,70C 'make':56B 'messag':39B,54B,88C 'mime':8A,38B,87C 'mime4j':3A,27B,31B,76C,103C,116C 'packag':28B 'pars':9A,25B,36B,58B,86C 'prior':78C 'recommend':91C 'reli':100C 'resourc':5A,41B,62B,68C 'see':109C 'send':51B 'server':97C 'servic':13A,65B,84C 'throttl':45B,72C 'unbound':4A 'upgrad':93C 'upon':85C 'use':6A 'user':89C 'version':79C 'without':42B,69C","nicknames":[],"mitigations":[],"who_affected":"Any Java application that parses MIME messages with Mime4J before 0.8.15 is exposed, including mail processing code and the Apache James server itself. Systems that do not parse untrusted MIME input with this library, or that already run 0.8.15 or later, can skip it. The sources do not describe the exact input shape that triggers the excess allocation.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachejames","emailparsing","high","java","mime4j","package"],"campaign_type":null,"search_a":"'-2026':15A,18A '-85111':16A,19A 'apach':1A 'caus':10A 'cve':14A,17A 'denial':11A 'jame':2A 'let':7A 'mime':8A 'mime4j':3A 'pars':9A 'resourc':5A 'servic':13A 'unbound':4A 'use':6A","search_b":"'0.8.15':47B 'alloc':40B 'apach':21B,29B 'apache-jam':20B 'attack':49B 'code':59B 'consum':60B 'craft':53B 'deni':64B 'email':24B,37B 'email-pars':23B 'enough':61B 'jame':22B,30B 'java':26B,33B 'librari':34B 'limit':43B 'make':56B 'messag':39B,54B 'mime':38B 'mime4j':27B,31B 'packag':28B 'pars':25B,36B,58B 'resourc':41B,62B 'send':51B 'servic':65B 'throttl':45B 'without':42B","search_c":"'-2026':111C '-85108':112C '0.8.15':80C,104C '3.9.1':98C 'address':106C 'alloc':66C 'allow':81C 'apach':74C,95C,114C 'cve':110C 'denial':82C 'fix':102C 'issu':108C 'jame':75C,96C,115C 'librari':77C,117C 'limit':70C 'messag':88C 'mime':87C 'mime4j':76C,103C,116C 'pars':86C 'prior':78C 'recommend':91C 'reli':100C 'resourc':68C 'see':109C 'server':97C 'servic':84C 'throttl':72C 'upgrad':93C 'upon':85C 'user':89C 'version':79C 'without':69C","first_public_at":"2026-11-06T12:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85111","severity":null,"published_at":"2026-11-06T12:17:23+00:00","modified_at":"2026-11-06T12:17:23+00:00","first_seen_at":"2026-11-06T12:41:49+00:00","fetched_at":"2026-11-06T12:41:49+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}