How severe is CVE-2021-40110?

CVE-2021-40110 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2021-40110 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (85th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-40110?

CVE-2021-40110 affects Apache James. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-40110?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2021-40110 published?

CVE-2021-40110 was published on 2022-01-04 and last updated on 2026-06-17.

CVE-2021-40110

CVE-2021-40110 is a high-severity vulnerability in Apache James with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 5.0
EPSS exploit prediction: 3% (85th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Apache James
Published: 2022-01-04
Last modified: 2026-06-17

Description

In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of RE2J regular expression engine to execute regex in linear time without back-tracking.

Frequently asked questions

What is CVE-2021-40110?: In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of RE2J regular expression engine to execute regex in linear time without back-tracking.
How severe is CVE-2021-40110?: CVE-2021-40110 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2021-40110 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (85th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-40110?: CVE-2021-40110 affects Apache James. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-40110?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2021-40110 published?: CVE-2021-40110 was published on 2022-01-04 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:apache:james:*:*:*:*:*:*:*:*

More vulnerabilities in Apache James

CVE-2023-51518 — Critical (CVSS 9.8): Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication…
CVE-2019-0228 — Critical (CVSS 9.8): Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct…
CVE-2021-40525 — Critical (CVSS 9.1): Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path…
CVE-2023-26269 — High (CVSS 7.8): Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This…
CVE-2006-2806 — High (CVSS 7.8): The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows remote attackers to cause a…
CVE-2022-28220 — High (CVSS 7.5): Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS…

All CVEs affecting Apache James →