CVE-2026-76171

Description

In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

References

https://lists.apache.org/thread.html/goj9xc05nbk1dp0z2g3r264j537lvx9r

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-118217

http://www.openwall.com/lists/oss-security/2026/11/06/17

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3