CVE-2026-107576: CWE-407: Inefficient Algorithmic Complexity in Progressive Robot Ltd hMailServer

The vulnerability CVE-2026-107576 in hMailServer 6.0.0 through 6.3.5 is due to inefficient algorithmic complexity in the inbound DKIM and ARC signature verification. Specifically, the process of building canonical headers and selecting header fields named in a signature's h= tag involves operations whose time grows quadratically with the size of the message header. The 'simple' canonicalisation method prepends continuation lines of folded fields inefficiently, and both canonicalisations search and erase matched header fields from the middle of the list repeatedly. An attacker can exploit this by sending messages with very large or heavily folded headers signed with a DKIM signature for a domain they control, causing worker threads to be occupied for tens of seconds per signature. Since up to ten signatures are evaluated per message by DKIM and DMARC tests, this can lead to denial of service by exhausting processing resources.

The vulnerability allows a remote unauthenticated attacker to cause a denial of service by making mail services unavailable. The attack exploits the quadratic time complexity in signature verification, tying up worker threads for extended periods and degrading or halting mail processing. There is no impact on confidentiality or integrity reported, only availability is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting the size and complexity of inbound email headers or applying rate limiting to mitigate potential denial of service. Monitor vendor communications for official patches or updates.