Apache James Mime4J: Denial of Service

Apache James Mime4J Core, Apache James Mime4J Dom

Apache James Mime4J library prior to 0.8.15 has a Denial of Service vulnerability, users should upgrade to 0.8.15

Do this now

Upgrade Apache James Mime4J Core to 0.8.15, Apache James Mime4J Dom to 0.8.15 and Apache James to 3.9.1, matching your release line.

Fix it

Apache James Mime4J Core

Upgrade to Apache James Mime4J Core 0.8.15

Apache James Mime4J Dom

Upgrade to Apache James Mime4J Dom 0.8.15

Apache James

Upgrade to Apache James 3.9.1

First seen: 6 Nov 2026
Last update: 6 Nov 2026, 17:18 UTC
Fixed in: Apache James Mime4J Core 0.8.15
Apache James Mime4J Dom 0.8.15
Apache James 3.9.1
Identifiers: CVE-2026-85108
CVE-2026-85111
CVSS: 8.7
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Apache James Mime4J: Denial of Service
Severity: high. Patch status: patched.
Affected: Apache James Mime4J Core, Apache James Mime4J Dom
Fixed in: Apache James Mime4J Core 0.8.15, Apache James Mime4J Dom 0.8.15, Apache James 3.9.1
Ids: CVE-2026-85108, CVE-2026-85111

Apache James Mime4J library prior to 0.8.15 has a Denial of Service vulnerability, users should upgrade to 0.8.15

## Steps
1. Search the repo, its CI and infra config for Apache James Mime4J Core, Apache James Mime4J Dom. If present, report the version in use and whether it's affected.
2. Fix by release line: Apache James Mime4J Core: 0.8.15. Apache James Mime4J Dom: 0.8.15. Apache James: 3.9.1.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Apache James Mime4J Core | fixed | 0.8.15 | — |
| Apache James Mime4J Dom | fixed | 0.8.15 | — |
| Apache James | fixed | 3.9.1 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-85108") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://seclists.org/oss-sec/2026/q4/552 https://seclists.org/oss-sec/2026/q4/553
https://pwned.coffee/i/apache-james-mime4j-denial-of-service-cve-2026-85108

Timeline

6 Nov 2026, 17:17 UTC
Reported by seclists.org: CVE-2026-85111: Apache James: Denial of service upon MIME parsing
6 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Apache James Mime4J Core before 0.8.15 0.8.15 CVE record (CNA) checked 7 Nov
Apache James Mime4J Dom before 0.8.15 0.8.15 CVE record (CNA) checked 7 Nov
Apache James before 3.9.1 3.9.1 CVE record (CNA) checked 7 Nov
Score: CVSS 8.7 (high). CVSS 4.0 8.7 (CNA apache) for CVE-2026-85111
Last checked: 7 Nov 2026, 18:18 UTC

Product	Affected	Fixed in	Source
Apache James Mime4J Core	before 0.8.15	0.8.15	CVE record (CNA) checked 7 Nov
Apache James Mime4J Dom	before 0.8.15	0.8.15	CVE record (CNA) checked 7 Nov
Apache James	before 3.9.1	3.9.1	CVE record (CNA) checked 7 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Follow on X

Totalone hot coffee