Inefficient processing in hMailServer stalls mail delivery
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-407.
Summary
Progressive Robot hMailServer from 6.3.4 before 6.3.6 is affected. The readers of delivery status notifications and abuse feedback reports remove leading blank lines inefficiently, so their work grows with the square of the blank line count (CWE-407). A remote unauthenticated attacker can send such a report with a very large number of blank lines to keep a delivery thread busy for over a minute, and a few such messages per minute can stall all delivery threads.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery by sending messages, when bounce processing or complaint processing is enabled or a mailing list is managed by the server (none is by default). The readers of incoming delivery status notifications (RFC 3464) and abuse feedback reports (RFC 5965) removed the blank lines at the start of the returned headers part two bytes at a time, copying the rest of the part each time, so their work grew with the square of the number of blank lines. A message shaped like such a report, whose headers part begins with a very large number of blank lines within the reader's 2 MB limit, keeps a delivery thread busy for over a minute while it is delivered, and a few such messages a minute keep every delivery thread busy.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.3.4 to before 6.3.6 | 6.3.6 | Patch available | CNA |
- hMailServer VendorProgressive Robot Ltd Affected 6.3.4 to before 6.3.6 Fixed in 6.3.6 Patch available CNA
Remediation
Upgrade hMailServer to version 6.3.6, the fixed version.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA hMailServer (Progressive Robot Ltd) Fixed in 6.3.6
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Progressive Robot hMailServer 6.3.6
23 records Highest priority Priority LOW 23 LOW
Other records, highest priority first
- TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mailPriority LOW 39
- TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of servicePriority LOW 39
- TI-2026-69562 Inefficient JSON parsing in hMailServer lets attackers halt mailPriority LOW 39
Timeline
- 2026-10-08 Threatist record created from CVE-2026-107579
References
More Progressive Robot Ltd vulnerabilities
- TI-2026-64884 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer CVSS 3.1CRITICAL 9.8
- TI-2026-76418 Unchecked loop limit in hMailServer lets remote attackers stop mail CVSS 3.1HIGH 7.5
- TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mail CVSS 3.1HIGH 7.5
- TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of service CVSS 3.1HIGH 7.5
- TI-2026-69562 Inefficient JSON parsing in hMailServer lets attackers halt mail CVSS 3.1HIGH 7.5
- TI-2026-76416 hMailServer signs forged mail with hosted domain DKIM keys CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences