The vulnerability in the Apache James Mime4J library allows an attacker to trigger a denial of service by exploiting unchecked allocation of resources during MIME message parsing. By sending crafted MIME messages, an attacker can force the server to allocate excessive memory or computational resources, exhausting system capacity. The weakness is a classic resource exhaustion flaw (CWE-770) and results in loss of availability for all services relying on the affected JavaMail processing engine.

Apache James server deployments that incorporate Mime4J library versions prior to 0.8.15 are affected. This includes all Apache James releases before the 3.9.1 update, as the 3.9.1 release bundles the fixed 0.8.15 library. Any system running these versions and accepting MIME messages from external sources is vulnerable.

The CVSS score of 8.7 indicates a high severity. Because the exploit requires only the delivery of specially crafted MIME messages, it can be carried out from an external network without authentication or elevated privileges, making it highly accessible to attackers. The EPSS score is not available, but the lack of a KEV listing does not reduce the potential impact; resource exhaustion attacks remain a common failure mode for email servers. Without mitigation, an attacker can continuously submit large or malicious MIME payloads to overload the server, leading to service disruption for all users.