CVE-2026-107569: CWE-606: Unchecked Input for Loop Condition in Progressive Robot Ltd hMailServer

The vulnerability arises because hMailServer uses the X-hMailServer-LoopCount header to bound mail generation cycles, but it does not validate this header's value properly. The server reads the header with a signed conversion without validation, allowing negative values to bypass loop limits. On Linux builds, values above the 32-bit signed integer range wrap to negative, also bypassing limits. This leads to potentially billions of mail generation loops, filling the mail queue and disk, effectively stopping mail service. The Sieve notify action introduced in version 6.2.22 does not check limits and can overflow the signed integer counter. Additionally, accounts can reset the counter via Sieve editheader or rule Set header value actions, enabling exploitation.

An unauthenticated remote attacker can cause a denial of service by sending emails with manipulated X-hMailServer-LoopCount headers, triggering excessive mail generation loops. This exhausts server resources such as disk space and mail queue capacity, leading to mail service disruption. The vulnerability does not impact confidentiality or integrity but results in high availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider filtering or blocking emails with suspicious or malformed X-hMailServer-LoopCount headers if possible. Monitoring mail queue sizes and resource usage may help detect exploitation attempts. Avoid relying on Sieve notify and header modification rules that can reset or overflow the loop counter.