What is CVE-2021-40110?

CVE-2021-40110 is a high-severity vulnerability in Apache James. CVSS score: 7.5/10. Published 2022-01-04.

How severe is CVE-2021-40110?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Apache James

CVE-2021-40110

In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of RE2J regular expression engine to execute regex in linear time without back-tracking.

Published 2022-01-04 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.030 (87.2th percentile), scored 2026-11-01.

Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 87.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.029 · newest: 0.030 · change: +0.001

Affected products

Apache James
Apache Software Foundation James — versions Apache James

References

www.openwall.com/lists/oss-security/2022/01/04/2 (Mailing List, Third Party Advisory)
www.openwall.com/lists/oss-security/2022/01/04/2 (mailing-list, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2021-40110?: CVE-2021-40110 is a high-severity vulnerability in Apache James. CVSS score: 7.5/10. Published 2022-01-04.
How severe is CVE-2021-40110?: High severity. CVSS v3 base score is 7.5 out of 10.