Description
Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. To show a snippet of each message in a folder's message list, the server decoded the character entity references of a message that has an HTML part and no text part with a string replacement whose work grew with the square of their number. A received HTML-only message holding a very large number of entity references therefore keeps one of the listener's four worker threads busy for minutes or longer each time the recipient's webmail lists the folder, without the message being opened, so that a few such listings leave the HTTP listener unable to answer anybody. The IMAP PREVIEW response read such text the same way, holding an IMAP thread for each client that asks for the preview of such a message. The flaw is in the server's shared string class, whose replace and remove both ran in quadratic time.
Published: 2026-10-08
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

An inefficiency in hMailServer’s string replacement algorithm allows a remote, unauthenticated attacker to trigger a denial of service by sending an HTML‑only message containing a very large number of entity references. The server’s decoding routine runs in quadratic time, causing one of the REST or IMAP listener threads to become occupied for minutes or longer each time the infected message is listed. Consequently, the webmail interface, administration console, and REST API can be rendered unavailable without the victim opening the message.

Affected Systems

The vulnerability affects versions 6.3.3 through 6.3.5 of hMailServer’s REST API and versions 6.2.22 through 6.3.5 of the IMAP PREVIEW functionality in products from Progressive Robot Ltd.

Risk and Exploitability

With a CVSS score of 6.5 the flaw is considered moderate severity, and it is not currently tracked in CISA’s KEV catalog. Exploitation requires only network access to the affected ports; the attacker can send a crafted message remotely without authentication. Because the exploit leads to a prolonged service block of an individual listener thread, the impact is localized to webmail or IMAP clients, but repeated attacks can exhaust all listener threads and deny service to all users.

Generated by OpenCVE AI on October 8, 2026 at 13:20 UTC.

Remediation

Vendor Solution

Upgrade to hMailServer 6.3.6, whose string replacement and removal write their result in one pass. Until then: lower the maximum message size, which bounds the cost (it grows with the square of the HTML's size); remove such a message over IMAP or POP3; or keep the REST listener off (RestApiPort 0, the default).

OpenCVE Recommended Actions

  • Upgrade hMailServer to version 6.3.6, which processes string replacement and removal in a single pass.
  • If immediate upgrade is not possible, limit the maximum message size to keep the algorithmic cost bounded.
  • Delete or retrieve the offending messages via IMAP or POP3 to free the occupied threads.
  • Disable the REST listener when the service is not required by setting RestApiPort to 0.

Generated by OpenCVE AI on October 8, 2026 at 13:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Progressive Robot
Progressive Robot hmailserver
Vendors & Products Progressive Robot
Progressive Robot hmailserver

Thu, 08 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Description Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. To show a snippet of each message in a folder's message list, the server decoded the character entity references of a message that has an HTML part and no text part with a string replacement whose work grew with the square of their number. A received HTML-only message holding a very large number of entity references therefore keeps one of the listener's four worker threads busy for minutes or longer each time the recipient's webmail lists the folder, without the message being opened, so that a few such listings leave the HTTP listener unable to answer anybody. The IMAP PREVIEW response read such text the same way, holding an IMAP thread for each client that asks for the preview of such a message. The flaw is in the server's shared string class, whose replace and remove both ran in quadratic time.
Title Inefficient Algorithmic Complexity in hMailServer
Weaknesses CWE-407
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Progressive Robot Hmailserver
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-10-08T14:18:43.966Z

Reserved: 2026-10-08T10:52:15.637Z

Link: CVE-2026-107582

cve-icon Vulnrichment

Updated: 2026-10-08T14:18:40.517Z

cve-icon NVD

Status : Deferred

Published: 2026-10-08T12:17:16.480

Modified: 2026-10-08T21:02:43.860

Link: CVE-2026-107582

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T13:45:05Z

Weaknesses
  • CWE-407

    Inefficient Algorithmic Complexity