CVE-2026-107577 Details
Description
Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote unauthenticated attacker to make the mail services unavailable by sending a message. Removing a MIME header parameter whose value is empty and directly followed by a semicolon (for example a Content-Disposition with 'filename=a.bat; filename=;') entered a loop that never terminates, holding a worker thread at full load until the server is restarted; this is reached when the attachment blocker renames a blocked attachment or a filename is set over the REST API. Separately, decoding a header field that holds many RFC 2047 encoded words of an encoding other than base64 or quoted-printable, removing a parameter with many RFC 2231 continuations, and deleting many header fields of one name each took time growing with the square of the message, on the small thread pools that serve IMAP, SMTP and POP3 connections, delivery and the REST API.
A denial-of-service vulnerability has been identified in Progressive Robot hMailServer versions 6.0.0 through 6.3.5. The issue arises from an inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages. This vulnerability allows a remote unauthenticated attacker to disrupt mail services by sending a specially crafted message. The problem occurs when a MIME header parameter, such as 'Content-Disposition' with an empty value followed by a semicolon, is processed. This scenario triggers a loop that consumes a worker thread at full load, causing the mail service to become unresponsive until the server is restarted. Additionally, decoding header fields with many RFC 2047 encoded words, removing parameters with multiple RFC 2231 continuations, and deleting numerous header fields of the same name can also degrade performance, with the impact growing quadratically with the size of the message.
Users are advised to upgrade to hMailServer version 6.3.6, which addresses this vulnerability. Instructions for upgrading are available in the release notes for version 6.3.6.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6 | [email protected] | Release NotesVendor |
| https://gitlab.com/hmailserver/hmailserver/-/work_items/72 | [email protected] | Issue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Progressive Robot hMailServer | >= 6.0.0, <= 6.3.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |