by Kastro
Paper/Archive/CVE-2026-76171

CVE-2026-76171

Apache Software Foundation Apache James — Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client

EPSS 0.2%CVSS 9.1
critical.is priorityof 100
30
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 12.5.125 × 202.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

Affected

ProductAffectedFixed inSource
Apache James3.9.0 – < 3.9.13.9.1CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread.html/goj9xc05nbk1dp0z2g3r264j537lvx9rrefopenwall.com/lists/oss-security/2026/11/06/17