Inefficient algorithmic complexity in hMailServer SPF macro expansion
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-407.
Summary
Progressive Robot Ltd hMailServer from 6.3.4 before 6.3.6 has an inefficient algorithmic complexity flaw (CWE-407) in SPF macro expansion. Over-long names lose one label at a time with the whole rest of the name copied each step, so the work grows with the square of the expansion. A remote unauthenticated attacker can publish a crafted SPF record for a domain they control, making SPF checks of mail from that domain take several seconds.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels from the left; the server did this by removing one label at a time and copying the rest of the name each time, so the work grew with the square of the expansion. An attacker who publishes an SPF record for a domain they control, with a mechanism whose domain-spec expands through macros to a name far longer than 253 characters, makes the SPF check of a message from that domain take several seconds. The expansion is bounded by SPF's own per-term and per-macro limits, so the loss of availability is partial.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.3.4 to before 6.3.6 | 6.3.6 | Patch available | CNA |
- hMailServer VendorProgressive Robot Ltd Affected 6.3.4 to before 6.3.6 Fixed in 6.3.6 Patch available CNA
Remediation
Upgrade hMailServer to version 6.3.6, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA hMailServer (Progressive Robot Ltd) Fixed in 6.3.6
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Progressive Robot hMailServer 6.3.6
23 records Highest priority Priority LOW 23 LOW
Other records, highest priority first
- TI-2026-69567 Inefficient processing in hMailServer stalls mail deliveryPriority LOW 39
- TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mailPriority LOW 39
- TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of servicePriority LOW 39
Timeline
- 2026-10-08 Threatist record created from CVE-2026-107575
References
More Progressive Robot Ltd vulnerabilities
- TI-2026-64884 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer CVSS 3.1CRITICAL 9.8
- TI-2026-76418 Unchecked loop limit in hMailServer lets remote attackers stop mail CVSS 3.1HIGH 7.5
- TI-2026-69567 Inefficient processing in hMailServer stalls mail delivery CVSS 3.1HIGH 7.5
- TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mail CVSS 3.1HIGH 7.5
- TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of service CVSS 3.1HIGH 7.5
- TI-2026-69562 Inefficient JSON parsing in hMailServer lets attackers halt mail CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences