Read the docs
TI-2026-69568 Aliases CVE-2026-107580

Slow header processing in hMailServer enables denial of service

Priority LOW 28CWE-407Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-407.

Summary

Progressive Robot hMailServer from 6.0.0 before 6.3.6 is affected. Inefficient algorithmic complexity (CWE-407) in decoding message header fields makes the unfolding work grow with the square of the number of line breaks. A remote unauthenticated attacker can make the IMAP, SMTP and POP3 services or the webmail unavailable by sending a message with such a header value.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the IMAP, SMTP and POP3 services, or the webmail, unavailable by sending a message. The server unfolded a decoded header value by finding each line break from the end of the value and removing it, moving the rest of the value each time, so its work grew with the square of the number of line breaks, and an RFC 2047 encoded word may decode to any number of them. A received message whose Subject or other header field holds such a value keeps a worker thread busy for minutes or longer each time the value is read: when the recipient's IMAP client searches, sorts or threads the folder by a header, when the webmail lists the folder, and, where configured, when a rule tests a header, a spam tag is added to the Subject or an abuse report is read during delivery. The IMAP worker threads are shared with SMTP and POP3, so a few such messages stop those services responding. The server's reading of a message header from its file also searched everything read so far after each 4,000 bytes, costing seconds for a header of tens of megabytes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Fix Fixed hMailServer (Progressive Robot Ltd): 6.3.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Progressive Robot LtdhMailServer6.0.0 to before 6.3.66.3.6Patch availableCNA
  • hMailServer VendorProgressive Robot Ltd Affected 6.0.0 to before 6.3.6 Fixed in 6.3.6 Patch available CNA

Remediation

Upgrade hMailServer to version 6.3.6, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA hMailServer (Progressive Robot Ltd) Fixed in 6.3.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Progressive Robot hMailServer 6.3.6

    23 records Highest priority Priority LOW 23 LOW

    Other records, highest priority first

    • TI-2026-69567 Inefficient processing in hMailServer stalls mail deliveryPriority LOW 39
    • TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mailPriority LOW 39
    • TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of servicePriority LOW 39
    Show all 23 records →

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-107580

References

Other 2

  • TI-2026-64884 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer CVSS 3.1CRITICAL 9.8
  • TI-2026-76418 Unchecked loop limit in hMailServer lets remote attackers stop mail CVSS 3.1HIGH 7.5
  • TI-2026-69567 Inefficient processing in hMailServer stalls mail delivery CVSS 3.1HIGH 7.5
  • TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mail CVSS 3.1HIGH 7.5
  • TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of service CVSS 3.1HIGH 7.5
  • TI-2026-69562 Inefficient JSON parsing in hMailServer lets attackers halt mail CVSS 3.1HIGH 7.5
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences