Read the docs
TI-2026-69565 Aliases CVE-2026-107577

Infinite loop in hMailServer MIME handling lets attackers stop mail

Priority LOW 39CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-835.

Summary

Progressive Robot hMailServer from 6.0.0 before 6.3.6 contains an infinite loop (CWE-835) in the MIME processing of received messages. A remote unauthenticated attacker can send a crafted message that makes the loop never end, holding a worker thread at full load until the server is restarted and making the mail services unavailable. Several other message processing paths also take time that grows with the square of the message size.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote unauthenticated attacker to make the mail services unavailable by sending a message. Removing a MIME header parameter whose value is empty and directly followed by a semicolon (for example a Content-Disposition with 'filename=a.bat; filename=;') entered a loop that never terminates, holding a worker thread at full load until the server is restarted; this is reached when the attachment blocker renames a blocked attachment or a filename is set over the REST API. Separately, decoding a header field that holds many RFC 2047 encoded words of an encoding other than base64 or quoted-printable, removing a parameter with many RFC 2231 continuations, and deleting many header fields of one name each took time growing with the square of the message, on the small thread pools that serve IMAP, SMTP and POP3 connections, delivery and the REST API.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00428 37th percentileScored 2026-11-07
Fix Fixed hMailServer (Progressive Robot Ltd): 6.3.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Progressive Robot LtdhMailServer6.0.0 to before 6.3.66.3.6Patch availableCNA
  • hMailServer VendorProgressive Robot Ltd Affected 6.0.0 to before 6.3.6 Fixed in 6.3.6 Patch available CNA

Remediation

Upgrade hMailServer to version 6.3.6, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA hMailServer (Progressive Robot Ltd) Fixed in 6.3.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Progressive Robot hMailServer 6.3.6

    23 records Highest priority Priority LOW 23 LOW

    Other records, highest priority first

    • TI-2026-69567 Inefficient processing in hMailServer stalls mail deliveryPriority LOW 39
    • TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of servicePriority LOW 39
    • TI-2026-69562 Inefficient JSON parsing in hMailServer lets attackers halt mailPriority LOW 39
    Show all 23 records →

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-107577

References

Other 2

  • TI-2026-64884 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer CVSS 3.1CRITICAL 9.8
  • TI-2026-76418 Unchecked loop limit in hMailServer lets remote attackers stop mail CVSS 3.1HIGH 7.5
  • TI-2026-69567 Inefficient processing in hMailServer stalls mail delivery CVSS 3.1HIGH 7.5
  • TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of service CVSS 3.1HIGH 7.5
  • TI-2026-69562 Inefficient JSON parsing in hMailServer lets attackers halt mail CVSS 3.1HIGH 7.5
  • TI-2026-76416 hMailServer signs forged mail with hosted domain DKIM keys CVSS 3.1HIGH 7.5
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences