CVE-2026-107580: CWE-407: Inefficient Algorithmic Complexity in Progressive Robot Ltd hMailServer

This vulnerability arises from inefficient handling of RFC 2047 encoded words in message header fields in hMailServer 6.0.0 through 6.3.5. The server decodes header values by repeatedly searching for line breaks from the end and moving the remaining value, resulting in work that grows quadratically with the number of line breaks. An attacker can exploit this by sending a message with a header field containing many encoded line breaks, causing worker threads to be tied up for minutes or longer during operations such as IMAP searches, sorting, threading, webmail folder listing, and rule processing. Because IMAP worker threads are shared with SMTP and POP3, these services also become unresponsive. Additionally, reading large headers involves repeated searches every 4,000 bytes, further increasing processing time.

The vulnerability allows a remote unauthenticated attacker to cause denial of service by making the IMAP, SMTP, POP3, and webmail services unavailable. The attack exploits inefficient header decoding to exhaust worker threads, leading to service unavailability. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider limiting exposure to untrusted email sources or applying rate limiting on incoming messages to reduce the risk of denial of service.