Is CVE-2026-85111 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85111 being exploited in the wild.

How severe is CVE-2026-85111?

Informational severity, published 6 November 2026.

Which products and versions are affected?

Apache James prior to 3.9.1; Apache Mime4J prior to 0.8.15.

Is there a fix for CVE-2026-85111?

Yes: fixed in Mime4J 0.8.15; Apache James 3.9.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85111 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85111?

Check whether you run Apache James or Apache Mime4J at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85111: Apache James Mime4J resource exhaustion in MIME parsing

CVE-2026-85111 · Severity: info · Published 2026-11-06

Apache James Mime4J is a library that parses email MIME messages used by email servers and applications. A flaw allows attackers to craft malicious MIME messages that consume unlimited system resources during parsing, causing the email server or service to become unresponsive or crash, resulting in a denial of service.

Technologies: Apache James. Vendors: Apache.

Quick answers

Is CVE-2026-85111 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85111 being exploited in the wild.
How severe is CVE-2026-85111?: Informational severity, published 6 November 2026.
Which products and versions are affected?: Apache James prior to 3.9.1; Apache Mime4J prior to 0.8.15.
Is there a fix for CVE-2026-85111?: Yes: fixed in Mime4J 0.8.15; Apache James 3.9.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85111 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85111?: Check whether you run Apache James or Apache Mime4J at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Mime4J 0.8.15; Apache James 3.9.1

Technical details

The vulnerability is an allocation of resources without limits or throttling (CWE-770) in the MIME message parser that fails to enforce bounds on resource consumption during parsing. An attacker can send a specially crafted MIME message that triggers excessive resource allocation, leading to denial of service. The flaw is fixed in Mime4J version 0.8.15 and Apache James server 3.9.1.

Affected products

Apache Mime4J prior to 0.8.15
Apache James prior to 3.9.1

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.