CVE-2026-107575: CWE-407: Inefficient Algorithmic Complexity in Progressive Robot Ltd hMailServer

The vulnerability in hMailServer 6.3.4 and 6.3.5 stems from inefficient handling of SPF macro expansions when processing SPF records that include domain names longer than 253 characters. According to RFC 7208 section 7.1, names too long to look up should lose whole labels from the left. The server implements this by removing one label at a time and copying the remainder repeatedly, resulting in a quadratic increase in processing time. An attacker controlling a domain can craft an SPF record with macros that expand to very long domain names, causing SPF checks to consume excessive worker-thread time and degrade server availability partially. The expansion is limited by SPF's own per-term and per-macro limits, preventing a complete denial of service. This vulnerability affects versions >=6.3.4 and <6.3.6 of hMailServer.

The impact is a partial denial of service condition caused by high resource consumption during SPF checks. This can slow down processing of emails from attacker-controlled domains, potentially degrading mail server performance. There is no impact on confidentiality or integrity. The denial of service is partial and bounded by SPF limits, so it does not cause complete service outage.

No official patch or fix information is provided in the vendor advisory or CVE data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider monitoring SPF record usage and potentially filtering or rate-limiting SPF checks for suspicious domains with unusually long macro expansions to mitigate resource exhaustion.