- Latest release
- 3.9.1 (Sep 25, 2026): no advisory affects it
- Newest unaffected release
- 3.9.1 (Sep 25, 2026), the latest release
- Advisories
- 12 · 1 critical, 2 high, 1 medium
- Dependents
- 1
- Releases
- 28 since 3.0.0 (Jul 18, 2017)
- Registry
- Maven Central
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-85111Affects 3.0-beta2 to 3.9.0 (3.9.1 is outside it)
- CVE-2023-51747Affects 3.0-beta2 to 3.7.4 (3.7.5 is outside it); 3.8.0 (3.8.1 is outside it)
- CVE-2023-51518Affects 3.0-beta2 to 3.7.4 (3.7.5 is outside it); 3.8.0 (3.8.1 is outside it)
- CVE-2022-45935Affects 3.0-beta2 to 3.7.2 (3.7.3 is outside it)
- CVE-2022-28220Affects 3.0-beta2 to 3.7.0 (3.7.1 is outside it)
- CVE-2022-22931Affects 3.0-beta2 to 3.6.0 (3.6.2 is outside it)
- CVE-2021-40525Affects 3.0-beta2 to 3.6.0 (3.6.2 is outside it)
- CVE-2021-40111Affects 3.0-beta2 to 3.6.0 (3.6.2 is outside it)
- CVE-2021-40110Affects 3.1.0 to 3.6.0 (3.6.2 is outside it)
- CVE-2021-38542Affects 3.0-beta2 to 3.6.0 (3.6.2 is outside it)
- CVE-2015-7611No published release is affectedNo published release is affected
- CVE-2004-2650No published release is affectedNo published release is affected
Advisories 12
- CVE-2026-85111High 8.7
Apache James: Denial of service upon MIME parsing
Affected: fixed in 3.9.1.
Fixed in 3.9.1 (released Sep 25, 2026, 42 days before disclosure).
The latest release, 3.9.1, is not affected.
- CVE-2023-51747High 7.1
SMTP smuggling in Apache James
Affected: fixed in 3.7.5; from 3.8.0, fixed in 3.8.1.
Fixed in 3.7.5 (released Feb 12, 2024, 15 days before disclosure) and 3.8.1 (released Feb 11, 2024, 16 days before disclosure).
The latest release, 3.9.1, is not affected.
- CVE-2023-51518Critical 9.8
Apache James server: Privilege escalation via JMX pre-authentication deserialisation
Affected: fixed in 3.7.5; from 3.8.0, fixed in 3.8.1.
Fixed in 3.7.5 (released Feb 12, 2024, 15 days before disclosure) and 3.8.1 (released Feb 11, 2024, 16 days before disclosure).
The latest release, 3.9.1, is not affected.
- CVE-2022-45935Medium 5.5
Apache James server: Temporary File Information Disclosure
Affected: through 3.7.2.
Fixed in 3.7.3 (released Dec 30, 2022, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 3.9.1, is not affected.
- CVE-2022-28220Unrated
STARTTLS command injection in Apache JAMES
Affected: fixed in 3.6.3; from 3.7.0, fixed in 3.7.1.
Fixed in 3.7.1 (released Aug 26, 2022, 13 days before disclosure, the advisory names 3.6.3, which was never published).
The latest release, 3.9.1, is not affected.
- CVE-2022-22931Unrated
Path traversal in Apache James 3.6.1
Affected: fixed in 3.6.2.
Fixed in 3.6.2 (released Jan 26, 2022, 12 days before disclosure).
The latest release, 3.9.1, is not affected.
- CVE-2021-40525Unrated
Sieve file storage vulnerable to path traversal attacks
Affected: fixed in 3.6.1.
Fixed in 3.6.2 (released Jan 26, 2022, 22 days after disclosure, the advisory names 3.6.1, which was never published).
The latest release, 3.9.1, is not affected.
- CVE-2021-40111Unrated
Apache James IMAP parsing Denial Of Service
Affected: fixed in 3.6.1.
Fixed in 3.6.2 (released Jan 26, 2022, 22 days after disclosure, the advisory names 3.6.1, which was never published).
The latest release, 3.9.1, is not affected.
- CVE-2021-40110Unrated
Apache James IMAP vulnerable to a ReDoS
Affected: from 3.1.0, fixed in 3.6.1.
Fixed in 3.6.2 (released Jan 26, 2022, 22 days after disclosure, the advisory names 3.6.1, which was never published).
The latest release, 3.9.1, is not affected.
- CVE-2021-38542Unrated
Apache James vulnerable to STARTTLS command injection (IMAP and POP3)
Affected: fixed in 3.6.1.
Fixed in 3.6.2 (released Jan 26, 2022, 22 days after disclosure, the advisory names 3.6.1, which was never published).
The latest release, 3.9.1, is not affected.
- CVE-2015-7611Unrated
Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via…
Affected: fixed in 2.3.2.1.
Fixed in 3.0.0 (released Jul 18, 2017, 406 days after disclosure, the advisory names 2.3.2.1, which was never published).
The latest release, 3.9.1, is not affected.
- CVE-2004-2650Unrated
Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error…
Affected: fixed in 2.2.0.
Fixed in 3.0.0 (released Jul 18, 2017, 4239 days after disclosure, the advisory names 2.2.0, which was never published).
The latest release, 3.9.1, is not affected.