CVE-2021-40111

In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denial Of Service attack. The IMAP user needs to be authenticated to exploit this vulnerability. This affected Apache James prior to version 3.6.1. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade.

• CWE-835

• http://www.openwall.com/lists/oss-security/2022/01/04/3Mailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2022/01/04/3Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/01/04/3Mailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2022/01/04/3Mailing List, Third Party Advisory

Published

Jan 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40105An issue was discovered in Concrete CMS through 8.5.5. There…6.1
• CVE-2021-40106An issue was discovered in Concrete CMS through 8.5.5. There…6.1
• CVE-2021-40108An issue was discovered in Concrete CMS through 8.5.5. The C…8.8
• CVE-2021-40109A SSRF issue was discovered in Concrete CMS through 8.5.5. U…6.4
• CVE-2021-4011A flaw was found in xorg-x11-server in versions before 21.1.…7.8
• CVE-2021-40110In Apache James, using Jazzer fuzzer, we identified that an …7.5
• CVE-2021-40112Multiple vulnerabilities in the web-based management interfa…7.5
• CVE-2021-40113Multiple vulnerabilities in the web-based management interfa…9.8
• CVE-2021-40114Multiple Cisco products are affected by a vulnerability in t…7.5
• CVE-2021-40115A vulnerability in Cisco Webex Video Mesh could allow an una…6.1
• CVE-2021-40116Multiple Cisco products are affected by a vulnerability in S…7.5
• CVE-2021-40117A vulnerability in SSL/TLS message handler for Cisco Adaptiv…7.5