CVE-2021-40110: Denial of Service in Apache James
Summary
CVE-2021-40110: Denial of Service in Apache James. Affects org.apache.james:james-server versions >= 3.1.0, < 3.6.1. Fixed in 3.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache James is an open-source email server that provides a platform for sending, receiving, and storing emails. It is widely used in various applications and environments. However, prior to version 3.6.1, Apache James was vulnerable to a Denial of Service (DoS) attack due to a flaw in its IMAP implementation.
Vulnerability Detail
The vulnerability (CVE-2021-40110) in Apache James allows an attacker to orchestrate a DoS attack by crafting malicious IMAP LIST commands. This vulnerability is caused by a vulnerable regular expression used in the processing of these commands. By exploiting this flaw, an attacker can cause the server to consume excessive resources, leading to a complete denial of service for legitimate users. The vulnerability has a high severity rating and can be exploited remotely without authentication.
How To Fix
Latest published version: 3.9.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.6.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the patched version of Apache James to ensure the security and stability of the email server.
Conclusion
The vulnerability in Apache James (CVE-2021-40110) allows an attacker to perform a DoS attack by crafting malicious IMAP LIST commands. Upgrading to Apache James version 3.6.1 or higher is essential to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.james:james-server →
FAQ
Apache James is an open-source email server that provides email sending, receiving, and storage capabilities.
The vulnerability allows an attacker to orchestrate a DoS attack, causing the Apache James server to become unresponsive and denying service to legitimate users.
To fix this vulnerability, upgrade to Apache James version 3.6.1 or higher, which includes a patch for the vulnerability.
No, there is no known workaround for this vulnerability. Upgrading to the patched version is the recommended solution.
Yes, this vulnerability can be exploited remotely without authentication.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.james:james-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
