Cyber ·
CVE-2026-85108: Apache James MIME4J vulnerable to denial of service before 0.8.15
Advisory dated November 6, 2026 on unbounded resource allocation in Apache James Mime4J before version 0.8.15, which can cause denial of service while parsing MIME messages. It affects the core and dom artifacts; the recommendation is to update to 0.8.15.
Advisory CVE-2026-85108 states that Apache James Mime4J versions before 0.8.15 can suffer denial of service while parsing MIME messages. The stated cause is resource allocation without limits or control in the library. The advisory gives the severity as important. The affected components are Apache James Mime4J Core (org.apache.james:apache-mime4j-core) and Apache James Mime4J Dom (org.apache.james:apache-mime4j-dom), both before 0.8.15. The advisory recommends that users update to version 0.8.15, which fixes the problem. The original text was posted to the oss-sec list on November 6, 2026, and the feed shown here is a machine translation. To verify, search the oss-sec list or the official Apache James project repository for CVE-2026-85108 and confirm the affected versions and the fix before acting. This item is a security advisory, not a guide to using the platform.