CVE-2026-85108 Details
Description
Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults.
A denial-of-service vulnerability has been identified in the Apache James Mime4J library, specifically in versions prior to 0.8.15. The issue arises from the library's lack of resource allocation limits or throttling when parsing MIME messages, which can lead to excessive resource consumption. Users are advised to upgrade to version 0.8.15, which addresses the problem by implementing new limits and improving default settings.
Users should upgrade to Apache James Mime4J version 0.8.15 or later, which includes the necessary fixes. Instructions for upgrading can be found on the Apache James website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/11/06/18 | CVE | AdvisoryMailing ListRemedy |
| https://lists.apache.org/thread.html/twktm00gmc8lt7tlqrrj16xw7kzbx16s | [email protected] | AdvisoryMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache James Mime4J Core | < 0.8.15 (semver) |
CPE
Remediation
| |
| Apache James Mime4J Dom | < 0.8.15 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CVE |
| Nov 6, 2026 | New CVE Received | [email protected] |