CVE-2026-107574 - Vulnerability Details

Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unavailable. Reading a JSON object kept the first of each duplicated member name by searching the members already read, so an object of N distinct member names cost O(N^2): 1 MB took 8.9 seconds and 4 MB took 300 seconds against the affected code. A remote attacker reaches the reader without an account by mailing a crafted TLS-RPT report (up to 16 MB after decompression) to a hosted domain's published report mailbox, which is read on a delivery thread; a few such reports hold every delivery thread (ten by default), so the server delivers no mail, local or outbound, for over an hour per report. A signed-in account reaches the same 16 MB body through the webmail's own REST routes, holding the REST API's own worker threads. Where no report mailbox is configured, the unauthenticated REST sign-in routes that read a JSON body are capped at 64 KB and are not affected.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Progressive Robot Ltd

hMailServer

unaffected

Version	Status	Constraints
`6.2.28`	affected	< 6.3.6

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

Upgrade to hMailServer 6.3.6, which keeps the member names seen in a hash set, so a JSON object is read in one pass. Until then, where domain reports are on, move the report mailbox off a hosted domain; restart the service to end a busy thread.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6
https://gitlab.com/hmailserver/hmailserver/-/work_items/76

History

Thu, 08 Oct 2026 12:00:00 +0000

Type	Values Removed	Values Added
Description		Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unavailable. Reading a JSON object kept the first of each duplicated member name by searching the members already read, so an object of N distinct member names cost O(N^2): 1 MB took 8.9 seconds and 4 MB took 300 seconds against the affected code. A remote attacker reaches the reader without an account by mailing a crafted TLS-RPT report (up to 16 MB after decompression) to a hosted domain's published report mailbox, which is read on a delivery thread; a few such reports hold every delivery thread (ten by default), so the server delivers no mail, local or outbound, for over an hour per report. A signed-in account reaches the same 16 MB body through the webmail's own REST routes, holding the REST API's own worker threads. Where no report mailbox is configured, the unauthenticated REST sign-in routes that read a JSON body are capped at 64 KB and are not affected.
Title		Inefficient Algorithmic Complexity in hMailServer
Weaknesses		CWE-407
References		https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6 https://gitlab.com/hmailserver/hmailserver/-/work_items/76
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`