CVE-2026-76171 Details
Description
In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses. Users are recommended to upgrade to version 3.9.1 which fixes this issue.
A server-side request forgery (SSRF) vulnerability has been identified in Apache James Server versions prior to 3.9.1. The issue arises from improper validation in the JMAP WebPush subscription handling, which could allow external users to access internal addresses. Users are advised to upgrade to version 3.9.1, which addresses this vulnerability.
Users are recommended to upgrade to Apache James Server version 3.9.1 or later, which fixes this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/11/06/17 | CVE | AdvisoryMailing ListRemedy |
| https://lists.apache.org/thread.html/goj9xc05nbk1dp0z2g3r264j537lvx9r | [email protected] | AdvisoryMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache James | >= 3.9.0, < 3.9.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CVE |
| Nov 6, 2026 | New CVE Received | [email protected] |