CVE-2026-107577: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') in Progressive Robot Ltd hMailServer

This vulnerability arises from an infinite loop in the MIME processing component of hMailServer 6.0.0 through 6.3.5. Specifically, removing a MIME header parameter with an empty value directly followed by a semicolon (e.g., 'filename=a.bat; filename=;') causes a non-terminating loop that holds a worker thread at full CPU load until the server is restarted. This condition can be triggered remotely by sending a crafted message, including when the attachment blocker renames a blocked attachment or when a filename is set via the REST API. Separately, the server exhibits inefficient algorithmic complexity in decoding header fields with many RFC 2047 encoded words (non-base64 or quoted-printable), removing parameters with many RFC 2231 continuations, and deleting many header fields of the same name, resulting in processing time growing quadratically with message size. These inefficiencies affect the small thread pools serving IMAP, SMTP, POP3, delivery, and REST API connections, potentially degrading mail service availability.

An unauthenticated remote attacker can cause a denial of service by sending specially crafted email messages that trigger an infinite loop in MIME header processing, resulting in a worker thread consuming full CPU and making mail services unavailable until the server is restarted. The inefficient processing of certain header fields can also degrade performance significantly under load, impacting mail delivery and client connections. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider monitoring for unusual CPU usage related to hMailServer processes and potentially restrict or filter suspicious MIME headers or attachment renaming operations that could trigger the issue. No official fix or workaround is documented in the provided data.