Inefficient algorithmic complexity in hMailServer webmail message view
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-407.
Summary
Progressive Robot hMailServer from 6.3.2 before 6.3.6 contains inefficient algorithmic complexity in the webmail message view of its REST API. A remote unauthenticated attacker can make the webmail, administration console and REST API unavailable by sending a message whose HTML refers to one small embedded image a very large number of times, which the recipient opens in the webmail (CWE-407). The work grows with the square of the number of references, so a few such messages exhaust the HTTP listener's worker threads.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders a received message's HTML replaced each reference to an embedded image in place, with work that grew with the square of the number of references, and wrote the image out for every reference while counting it against its size limit only once. A message whose HTML refers to one small embedded image a very large number of times, opened in the webmail by its recipient, therefore keeps one of the listener's four worker threads busy for minutes and makes it build a document of gigabytes, so that a few such messages leave the HTTP listener unable to answer anybody.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.3.2 to before 6.3.6 | 6.3.6 | Patch available | CNA |
- hMailServer VendorProgressive Robot Ltd Affected 6.3.2 to before 6.3.6 Fixed in 6.3.6 Patch available CNA
Remediation
Upgrade hMailServer to version 6.3.6 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA hMailServer (Progressive Robot Ltd) Fixed in 6.3.6
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Progressive Robot hMailServer 6.3.6
23 records Highest priority Priority LOW 23 LOW
Other records, highest priority first
- TI-2026-69567 Inefficient processing in hMailServer stalls mail deliveryPriority LOW 39
- TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mailPriority LOW 39
- TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of servicePriority LOW 39
Timeline
- 2026-10-08 Threatist record created from CVE-2026-107583
References
More Progressive Robot Ltd vulnerabilities
- TI-2026-64884 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer CVSS 3.1CRITICAL 9.8
- TI-2026-76418 Unchecked loop limit in hMailServer lets remote attackers stop mail CVSS 3.1HIGH 7.5
- TI-2026-69567 Inefficient processing in hMailServer stalls mail delivery CVSS 3.1HIGH 7.5
- TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mail CVSS 3.1HIGH 7.5
- TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of service CVSS 3.1HIGH 7.5
- TI-2026-69562 Inefficient JSON parsing in hMailServer lets attackers halt mail CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences