Cyber ·
CVE-2026-85111: Apache James denial of service during MIME parsing
Advisory dated 6 Nov 2026 on unbounded resource allocation in the Mime4J library used by Apache James, rated CVSS 4.0 8.7 (high). The stated recommendation is to update to version 3.9.1.
The advisory describes an unbounded resource allocation flaw in the Mime4J library used by Apache James. According to the text, the flaw allows denial of service while MIME messages are parsed. Versions before 3.9.1 are affected. The corrected Mime4J library is 0.8.15, included in server version 3.9.1. The stated CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, meaning network exploitation, no authentication and no user interaction, with high availability impact. The information was published on the oss-sec list, and the available text is a machine translation of the original. To verify, search the public oss-sec list by CVE identifier and check the official Apache James release notes before applying the update. For organizations running the server, the practical step is to identify instances, plan the update and validate the service afterwards.
Original source: CVE-2026-85111: Apache James vulnerável a negação de serviço durante análise MIME