CVE-2026-85108— Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling

Quick assessment

Affected

Apache Software Foundation Apache James Mime4J Core

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Apache James Mime4J 库 0.8.15 版本之前，存在“资源分配未设置限制或缺乏流量控制”的漏洞。攻击者可利用该漏洞在解析 MIME 消息时触发拒绝服务（DoS）攻击。建议用户升级至 0.8.15 版本，该版本通过实施新的限制并提供更优的默认配置，修复了此问题。

AI Predicted 5.9 Difficulty: Trivial Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Updated Nov 06, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling

Source: CVE Program / CVE List V5

Vulnerability Description

Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache James Mime4J Core	0 ~ 0.8.15	-
Apache Software Foundation	Apache James Mime4J Dom	0 ~ 0.8.15	-

II. Public POCs for CVE-2026-85108

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-85108

请登录查看更多情报信息。

Other References for CVE-2026-85108 (1)

https://lists.apache.org/thread.html/twktm00gmc8lt7tlqrrj16xw7kzbx16s vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-85108

Same Patch Batch · Apache Software Foundation · 2026-11-06 · 7 CVEs total

CVE-2026-85111	8.7 HIGH	Apache James: Denial of service upon MIME parsing
CVE-2025-66621		Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
CVE-2026-49939		Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
CVE-2026-76171		Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client
CVE-2026-74756		Apache James: WebAdmin exposed without authentication on official Docker default
CVE-2026-76168		Apache James: ManageSieve file implementation cross-user path traversal

IV. Related Vulnerabilities

Same vendor: Apache Software Foundation

Same weakness: CWE-770