CVE-2026-107572: CWE-1333: Inefficient Regular Expression Complexity in Progressive Robot Ltd hMailServer

This vulnerability in hMailServer versions >=6.2.24 and <6.3.6 is caused by inefficient complexity in the Sieve filter evaluation. Specifically, the ':matches' pattern uses a backtracking descent whose time complexity grows exponentially with the number of wildcards and the length of the matched string. For example, a pattern like '*a*a*a*b' over 800 characters took 44 seconds to process. Additionally, the 'deleteheader' command removes fields one at a time, resulting in quadratic time complexity when removing many fields. Since Sieve filters run on a small, shared delivery thread pool, an authenticated user can craft a filter that consumes all threads by feeding messages to their own script, causing a denial of service for the entire mail server. The script can only affect the account holder's own filters, not those of other users.

An authenticated user can cause a denial of service by creating a Sieve filter that consumes excessive CPU time and thread pool resources, effectively stopping mail delivery for all users on the server. There is no impact on confidentiality or integrity, only availability is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should monitor for unusually resource-intensive Sieve filters and consider restricting or auditing user-created filters to prevent denial of service. Since the vulnerability requires authenticated access and affects only the user's own filters, limiting account privileges and monitoring filter usage can help mitigate risk.