CVE-2026-107575 Details

A denial-of-service vulnerability has been identified in Progressive Robot hMailServer versions 6.3.4 and 6.3.5. The issue arises from an inefficient algorithm in the SPF macro expansion process, which allows a remote, unauthenticated attacker to exploit the vulnerability by publishing a crafted SPF record. When a domain's SPF record includes a mechanism that expands through macros to a name significantly longer than 253 characters, the server's SPF check for messages from that domain can take several seconds to process. This delay is due to the server's method of handling long names, which involves removing one label at a time and copying the rest of the name with each iteration, resulting in a quadratic increase in processing time. Although the vulnerability does not completely disrupt email server operations, it can cause noticeable delays in processing messages, particularly when the DMARC anti-spam test is enabled, as this test also evaluates the sender's SPF record through the same macro expander.

Upgrade to Progressive Robot hMailServer version 6.3.6, which addresses the vulnerability by improving the SPF macro expansion algorithm to handle long names more efficiently. Instructions for upgrading are available in the hMailServer release notes for version 6.3.6.