Apache Apache James
13 CVEs affecting Apache Apache James. Latest disclosed: 2026-11-06. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-40525 | Critical | 9.1 | 2022-01-04 | Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any fi… |
CVE-2017-12628 | High | 7.8 | 2017-10-20 | The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbi… |
CVE-2022-28220 | High | 7.5 | 2022-09-08 | Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solv… |
CVE-2021-40110 | High | 7.5 | 2022-01-04 | In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regula… |
CVE-2021-40111 | Medium | 6.5 | 2022-01-04 | In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite lo… |
CVE-2021-38542 | Medium | 5.9 | 2022-01-04 | Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle comma… |
CVE-2022-22931 | Medium | 4.3 | 2022-02-07 | Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file reposi… |
CVE-2026-85111 | | 2026-11-06 | Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. U… | |
CVE-2026-76171 | | 2026-11-06 | In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses. Users a… | |
CVE-2026-76168 | | 2026-11-06 | In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set… | |
CVE-2026-74756 | | 2026-11-06 | Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup. Version 3.9.1 onward sets a ran… | |
CVE-2026-49939 | | 2026-11-06 | In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules posi… | |
CVE-2025-66621 | | 2026-11-06 | Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured. This al… |