CVE-2026-107579: CWE-407: Inefficient Algorithmic Complexity in Progressive Robot Ltd hMailServer
Description
Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery by sending messages, when bounce processing or complaint processing is enabled or a mailing list is managed by the server (none is by default). The readers of incoming delivery status notifications (RFC 3464) and abuse feedback reports (RFC 5965) removed the blank lines at the start of the returned headers part two bytes at a time, copying the rest of the part each time, so their work grew with the square of the number of blank lines. A message shaped like such a report, whose headers part begins with a very large number of blank lines within the reader's 2 MB limit, keeps a delivery thread busy for over a minute while it is delivered, and a few such messages a minute keep every delivery thread busy.
CVSS v3.1
Score 7.5high
Affected software
Progressive Robot Ltd
hMailServer
pkg:github/hmailserver/hmailserverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from inefficient handling of blank lines at the start of the headers part in incoming delivery status notifications (RFC 3464) and abuse feedback reports (RFC 5965). The processing code removes blank lines two bytes at a time, copying the rest each time, resulting in quadratic time complexity relative to the number of blank lines. An attacker can exploit this by sending messages with a large number of blank lines within the 2 MB limit, causing delivery threads to be occupied for over a minute per message. Multiple such messages per minute can exhaust all delivery threads, halting mail delivery. This affects hMailServer versions 6.3.4 and 6.3.5 when bounce or complaint processing is enabled or mailing lists are managed (none enabled by default).
Potential Impact
The impact is denial of service on mail delivery by exhausting delivery threads through resource-intensive processing of crafted messages. There is no confidentiality or integrity impact reported. The vulnerability requires no authentication and can be triggered remotely. It affects availability by stopping mail delivery under the specified conditions.
Mitigation Recommendations
No official patch or fix is currently available as per the provided data. Users should check the vendor advisory for updates. Until a fix is released, disabling bounce processing, complaint processing, or mailing list management (if enabled) can mitigate the risk. Monitoring and filtering incoming delivery status notifications and abuse feedback reports with unusually large numbers of blank lines may also help reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitLab
- Date Reserved
- 2026-10-08T10:52:00.639Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac786ba2cdf04f65611bbbc
Added to database: 10/08/2026, 12:04:10 UTC
Last enriched: 10/08/2026, 12:18:24 UTC
Last updated: 10/08/2026, 15:04:12 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.