Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for Apache James Mime4J Core by Apache Software Foundation

    CVE-2026-85108 (GCVE-0-2026-85108)

    Vulnerability from nvd – Published: 2026-11-06 11:46 – Updated: 2026-11-10 18:39
    VLAI
    Title
    Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling
    Summary
    Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-10 18:38 UTC
    CWE
    • CWE-770 - Allocation of resources without limits or throttling
    Assigner
    apache CNA under the mitre root
    CNA scorecard B 76/100 over 1276 records in the last 180 days details
    References
    Impacted products
    Credits
    Mike Read
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:05:13.588Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/11/06/18"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-85108",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T18:38:34.291574Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T18:39:08.391Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.james:apache-mime4j-core",
          "packageURL": "pkg:maven/org.apache.james/apache-mime4j-core",
          "product": "Apache James Mime4J Core",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.8.15",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "org.apache.james:apache-mime4j-dom",
          "packageURL": "pkg:maven/org.apache.james/apache-mime4j-dom",
          "product": "Apache James Mime4J Dom",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.8.15",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mike Read"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eAllocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.\u003cbr\u003eUsers are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults.\u003c/div\u003e"
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.\nUsers are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of resources without limits or throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T11:46:28.639Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread.html/twktm00gmc8lt7tlqrrj16xw7kzbx16s"
        }
      ],
      "source": {
        "defect": [
          "CWE-770"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-85108",
    "datePublished": "2026-11-06T11:46:28.639Z",
    "dateReserved": "2026-09-03T06:49:54.225Z",
    "dateUpdated": "2026-11-10T18:39:08.391Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-85108 (GCVE-0-2026-85108)

    Vulnerability from cvelistv5 – Published: 2026-11-06 11:46 – Updated: 2026-11-10 18:39
    VLAI
    Title
    Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling
    Summary
    Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-10 18:38 UTC
    CWE
    • CWE-770 - Allocation of resources without limits or throttling
    Assigner
    apache CNA under the mitre root
    CNA scorecard B 76/100 over 1276 records in the last 180 days details
    References
    Impacted products
    Credits
    Mike Read
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:05:13.588Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/11/06/18"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-85108",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T18:38:34.291574Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T18:39:08.391Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.james:apache-mime4j-core",
          "packageURL": "pkg:maven/org.apache.james/apache-mime4j-core",
          "product": "Apache James Mime4J Core",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.8.15",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "org.apache.james:apache-mime4j-dom",
          "packageURL": "pkg:maven/org.apache.james/apache-mime4j-dom",
          "product": "Apache James Mime4J Dom",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.8.15",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mike Read"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eAllocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.\u003cbr\u003eUsers are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults.\u003c/div\u003e"
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.\nUsers are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of resources without limits or throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T11:46:28.639Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread.html/twktm00gmc8lt7tlqrrj16xw7kzbx16s"
        }
      ],
      "source": {
        "defect": [
          "CWE-770"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-85108",
    "datePublished": "2026-11-06T11:46:28.639Z",
    "dateReserved": "2026-09-03T06:49:54.225Z",
    "dateUpdated": "2026-11-10T18:39:08.391Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}