Improper Validation in Apache James Server Exposes Internal Addresses

CVE-2026-76171

What is CVE-2026-76171?

The Apache James Server, prior to version 3.9.1, is susceptible to an improper validation vulnerability in the JMAP webPush feature. This flaw could allow an attacker to exploit the server's capabilities to access internal network addresses, potentially leading to unauthorized access to sensitive data. Users are strongly advised to upgrade to version 3.9.1, which addresses this security issue effectively.

References