Threats tagged 'ghsa-gxm7-28h3-vf9j'

A vulnerability in Progressive Robot hMailServer versions 6.3.6 and 6.3.7 involves inefficient algorithmic complexity in the JSON reader. This flaw allows a remote unauthenticated attacker to cause denial of service by holding mail delivery threads or REST API worker threads, making mail delivery, REST API, and webmail unavailable. The issue arises from the JSON reader's handling of member names in a hash set that can be manipulated to degrade performance significantly. The attack surface includes TLS-RPT reports mailed to a hosted domain's report mailbox, REST API requests without authentication, webmail routes, and the send API. The vulnerability has a CVSS score of 7.5 (high severity).