---
id: "CVE-2026-85111"
page: "https://infrastack.ai/live/CVE-2026-85111"
kind: "vulnerability"
aliases: ["CVE-2026-85111"]
title: "Apache James Mime4J: unbounded resource use lets MIME parsing cause denial of service"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-james", "email-parsing", "java", "mime4j", "package"]
not_affected_if: ["fixed-version", "no-mime-parsing"]
published_at: "2026-11-06T12:17:23+00:00"
first_seen_at: "2026-11-06T12:41:49+00:00"
updated_at: "2026-11-06T12:42:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85111", "first_seen_at": "2026-11-06T12:41:49+00:00"}]
exploit_sources: []
---

# Apache James Mime4J: unbounded resource use lets MIME parsing cause denial of service

Link for people: https://infrastack.ai/live/CVE-2026-85111 (this .md is for agents)

Apache James Mime4J, a Java library for parsing email MIME messages, allocates resources without limits or throttling before 0.8.15. An attacker who sends a crafted message can make the parsing code consume enough resources to deny service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Mime4J version in your dependency tree, for example `mvn dependency:tree` or `gradle dependencies`, looking for `apache-mime4j` or `org.apache.james:apache-mime4j` below `0.8.15`
- Check whether the Apache James server is in use and which version runs, since the sources point to James server `3.9.1` as the fixed build

## Fix

- Apache James Mime4J library: upgrade to `0.8.15` or later
- Apache James server: upgrade to `3.9.1`, which relies on the fixed Mime4J `0.8.15`

## Timeline

- 2026-11-06T12:41:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85111

## From the sources

Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.
Users are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue.

See CVE-2026-85108 in Apache James MIME4J library.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_