Cyber ·
CVE-2026-76171: SSRF filter bypass in the Apache James JMAP webPush client
Low-severity advisory: improper validation in the SSRF filter of JMAP webPush may allow access to internal addresses in Apache James versions before 3.9.1. Published November 6, 2026 on the oss-sec list, with the fix in 3.9.1.
Advisory CVE-2026-76171 describes improper validation in the SSRF filter of the JMAP webPush feature in the Apache James mail server. According to the text, the flaw may allow access to internal addresses. Affected versions are 3.9.0 before 3.9.1, and the recommendation is to upgrade to 3.9.1, which fixes the issue. The stated severity is low. The content was published on the oss-sec list on November 6, 2026, and this is an automatic translation of the original advisory. To verify details, consult the official CVE record and the Apache James project page, using the addresses listed in the source. For teams running mail servers, the relevance is checking whether any instance uses an affected version and planning the upgrade. This summary does not replace reading the original advisory.