CVE-2026-76171

Full vulnerability record from the local CVENow database.

Description

In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-06 12:17:21.910000

Last modified

2026-11-06 19:17:57.207000

View original CVE JSON

{
  "id": "CVE-2026-76171",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-06T12:17:21.910",
  "lastModified": "2026-11-06T19:17:57.207",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses.\nUsers are recommended to upgrade to version 3.9.1 which fixes this issue."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache James",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "3.9.0",
              "lessThan": "3.9.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread.html/goj9xc05nbk1dp0z2g3r264j537lvx9r",
      "source": "[email protected]"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/11/06/17",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}