CVE-2026-107574: CWE-407: Inefficient Algorithmic Complexity in Progressive Robot Ltd hMailServer

The vulnerability in hMailServer's JSON reader causes inefficient processing due to an O(N^2) algorithm when handling duplicated JSON member names. This inefficiency can be exploited by remote unauthenticated attackers sending large crafted TLS-RPT reports (up to 16 MB after decompression) to a hosted domain's report mailbox, which is processed on delivery threads. This leads to thread exhaustion and denial of service, preventing mail delivery for over an hour per report. Signed-in users can similarly exhaust REST API worker threads by sending large JSON bodies via webmail REST routes. Systems without a report mailbox configured and with REST routes limited to 64 KB JSON bodies are not vulnerable to this attack vector.

The vulnerability results in denial of service (DoS) by exhausting mail delivery and REST API worker threads, making mail services unavailable locally and outbound for extended periods. There is no impact on confidentiality or integrity. The attack requires no privileges or user interaction for the TLS-RPT report vector, making it remotely exploitable without authentication. The REST API vector requires a signed-in account but can similarly cause resource exhaustion.

No official patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling or restricting the TLS-RPT report mailbox or limiting the size of incoming JSON payloads if possible. Systems without a configured report mailbox and with REST sign-in routes capped at 64 KB are not affected by this vulnerability.