CVE-2026-107581: CWE-407: Inefficient Algorithmic Complexity in Progressive Robot Ltd hMailServer

The vulnerability arises from inefficient handling of several IMAP commands in hMailServer 6.0.0 through 6.3.5. The FETCH data-item parser performs repeated case-insensitive string replacements and copies, leading to quadratic time complexity relative to command length or the number of elements named. The server's case-insensitive search rechecks the needle at every position, causing costly operations for long SEARCH TEXT keys. Other IMAP commands like SEARCH message sets, SORT criteria, HEADER.FIELDS name lists, and UID ranges are processed repeatedly per message instead of once per command. Additionally, FETCH commands that reference many message sections read and hold all sections in memory before responding. IMAP commands can be very large (up to about 11 MB), and the IMAP worker threads are shared with SMTP and POP3, so this can cause all these services to become unresponsive due to resource exhaustion. This is classified under CWE-407 (Improper Control of Resource Consumption) and CWE-400 (Uncontrolled Resource Consumption).

An authenticated user can exploit this vulnerability by sending crafted IMAP commands that consume excessive CPU and memory resources, leading to denial of service conditions. This affects the availability of IMAP, SMTP, and POP3 services on the affected server. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit or monitor authenticated IMAP user activity to prevent abuse of resource-intensive commands. Consider restricting access or applying rate limiting on IMAP commands if possible.