Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Apache James IMAP Parsing Causes Infinite Loops, CPU Overload

CVE-2021-40111 · published 4 years ago
Summary

Apache James users with unpatched versions prior to 3.6.1 may be at risk of a denial-of-service attack. Hackers could send specific commands to trigger an infinite loop, causing the server to consume excessive CPU resources and potentially run out of memory. To protect against this, update to Apache James version 3.6.1 or higher.

What to do
  • Update apache org.apache.james:james-server to version 3.6.1.
  • Update apache james to version 3.6.1 or later.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.james:james-server < 3.6.1
Fix: upgrade to 3.6.1
– apache james < 3.6.1
cpe:2.3:a:apache:james:*:*:*:*:*:*:*:*
Original advisory text
In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computa...
In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denial Of Service attack. The IMAP user needs to be authenticated to exploit this vulnerability. This affected Apache James prior to version 3.6.1. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade.
References
Severity
6.5 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')
Timeline
Published4 Jan 2022
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-fqgw-6qj5-8hmp · GHSA
CVE-2021-40111 · NVD
Track software like this
Free during beta