Read the docs
TI-2026-85899 Aliases CVE-2026-85108GHSA-7j7p-grhm-j8xq

Denial of service in Apache James MIME4J from unlimited resource allocation

Priority LOW 22CWE-770Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Denial of service
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA. Impact type from CWE-770.

Summary

Apache James Mime4J Core and Apache James Mime4J Dom before 0.8.15 allocate resources without limits or throttling. An attacker can cause a denial of service upon parsing MIME messages (CWE-770).

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults.

Why it matters now

EPSS 0.00195 9th percentileScored 2026-11-07
Fix Fixed Apache James Mime4J Core (Apache Software Foundation): 0.8.15Apache James Mime4J Dom (Apache Software Foundation): 0.8.15

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache James Mime4J Corebefore 0.8.150.8.15Patch availableCNA
ApacheApache James Mime4J Dombefore 0.8.150.8.15Patch availableCNA
  • Apache James Mime4J Core VendorApache Affected before 0.8.15 Fixed in 0.8.15 Patch available CNA
  • Apache James Mime4J Dom VendorApache Affected before 0.8.15 Fixed in 0.8.15 Patch available CNA

Remediation

Upgrade Apache James Mime4J Core and Apache James Mime4J Dom to version 0.8.15, which enforces new limits and provides better defaults.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Apache James Mime4J Core (Apache Software Foundation) Fixed in 0.8.15
  • Fix · CNA Apache James Mime4J Dom (Apache Software Foundation) Fixed in 0.8.15

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-85108
  2. 2026-11-06 Alias added: GHSA-7j7p-grhm-j8xq

References

Advisory 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences