Description
Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mail. The server bounds the mail it generates in response to a message - a rule forward, reply or copy, an account forward, a Sieve redirect, vacation or notify, a bounce, an out-of-office reply - by a counter it carries in the message's X-hMailServer-LoopCount header, and makes no more once the counter reaches the configured rule loop limit (5 by default); that is what ends a forwarding or auto-reply cycle in a bounded number of hops. X-hMailServer-LoopCount is an ordinary header that is not stripped from mail arriving from outside, and the server read it with a signed conversion and no validation, so a count below zero passed every test against the limit: a sender who sets X-hMailServer-LoopCount to a negative value, or on the Linux builds to a value above the 32-bit signed range that the conversion wraps to a negative one, lifts the bound, and a message that enters a generated-mail cycle then loops up to about two thousand million times, each hop a queued message and a delivery, filling the queue and disk and stopping mail service. The Sieve notify action (from 6.2.22) consulted no limit at all, and its increment of the count could overflow a signed integer; and an account could reset the counter on its own mail through a Sieve editheader of the header (from 6.2.22) or a rule Set header value action (all versions) ahead of a forward or redirect.
Published: 2026-10-19
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

An unchecked conversion of the X-hMailServer-LoopCount header allows an attacker to supply a negative or overflow value that bypasses the built‑in limit on recursive message generation. Each rewrite of a message increments this counter; because the counter can start below zero or wrap around a 32‑bit signed integer, a crafted message can cause the server to generate well over two billion recursive deliveries. The resulting queue growth exhausts disk space and stops mail processing, effectively denying service for all users. This flaw also permits Sieve scripts to manipulate the counter directly. The weakness is a type of input validation failure (CWE‑606).

Affected Systems

The flaw exists in Progressive Robot Ltd’s hMailServer software versions 6.0.0 through 6.3.6. All installations that use the default rule‑loop limit of five and that have Sieve or the REST API enabled are susceptible, regardless of operating system.

Risk and Exploitability

With a CVSS score of 7.5 this vulnerability is considered high. The EPSS score is not provided, but because an attacker only needs to send a single crafted e‑mail or execute a Sieve script on an unauthenticated account, the exploit can be carried out remotely with minimal effort. The flaw is not listed in the CISA KEV catalog, yet the attack is straightforward and its impact is severe, making it a significant risk for affected servers.

Generated by OpenCVE AI on October 19, 2026 at 16:51 UTC.

Remediation

Vendor Solution

Upgrade to hMailServer 6.3.7, which reads X-hMailServer-LoopCount in one validated place (a count only when it is digits and never above the limit; anything else is read as the limit so no generated mail is made from it), holds a Sieve notify to the same limit, and refuses an account Sieve script or rule that edits the counter, and writes a line break in a header value as spaces unless it folds the line, so that no value a generated message is built from writes a field of its own. Until then there is no setting that stops the header being read or that turns Sieve off: reduce forwarding and auto-reply arrangements that can feed one another, keep the Sieve script surfaces closed to accounts (ManageSieveServerPort=0, the default, and the REST API off where it is not needed, RestApiPort=0, the default), review active Sieve scripts and account rules for a notify of the account's own address and for an edit of X-hMailServer-LoopCount, and watch the queue for a message generated far past the loop limit.

OpenCVE Recommended Actions

  • Apply the vendor patch by upgrading to hMailServer 6.3.7 promptly.
  • Temporarily disable Sieve and REST API if not required by setting ManageSieveServerPort=0 and RestApiPort=0.
  • Review all active Sieve scripts and account rules, and remove any that use X‑hMailServer‑LoopCount or notify actions that could bypass limits.
  • Minimize forwarding, auto‑reply, or vacation rules that can drive mail in a loop, and consider limiting the rule loop count if possible.
  • Monitor the mail queue and disk usage; if the queue grows unexpectedly or the server stops delivering mail, investigate potential loops.

Generated by OpenCVE AI on October 19, 2026 at 16:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Progressive Robot
Progressive Robot hmailserver
Vendors & Products Progressive Robot
Progressive Robot hmailserver

Mon, 19 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mail. The server bounds the mail it generates in response to a message - a rule forward, reply or copy, an account forward, a Sieve redirect, vacation or notify, a bounce, an out-of-office reply - by a counter it carries in the message's X-hMailServer-LoopCount header, and makes no more once the counter reaches the configured rule loop limit (5 by default); that is what ends a forwarding or auto-reply cycle in a bounded number of hops. X-hMailServer-LoopCount is an ordinary header that is not stripped from mail arriving from outside, and the server read it with a signed conversion and no validation, so a count below zero passed every test against the limit: a sender who sets X-hMailServer-LoopCount to a negative value, or on the Linux builds to a value above the 32-bit signed range that the conversion wraps to a negative one, lifts the bound, and a message that enters a generated-mail cycle then loops up to about two thousand million times, each hop a queued message and a delivery, filling the queue and disk and stopping mail service. The Sieve notify action (from 6.2.22) consulted no limit at all, and its increment of the count could overflow a signed integer; and an account could reset the counter on its own mail through a Sieve editheader of the header (from 6.2.22) or a rule Set header value action (all versions) ahead of a forward or redirect.
Title Unchecked Input for Loop Condition in hMailServer
Weaknesses CWE-606
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Progressive Robot Hmailserver
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-10-20T19:27:26.604Z

Reserved: 2026-10-08T10:51:10.642Z

Link: CVE-2026-107569

cve-icon Vulnrichment

Updated: 2026-10-20T19:27:22.333Z

cve-icon NVD

Status : Deferred

Published: 2026-10-19T16:17:01.830

Modified: 2026-10-20T20:17:13.973

Link: CVE-2026-107569

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T18:30:02Z

Weaknesses
  • CWE-606

    Unchecked Input for Loop Condition