Vulnerability · Published Oct 8, 2026 · Assigned by GitLab
CVE-2026-107583Inefficient Algorithmic Complexity in hMailServer
Medium 6.5
In plain English
A medium-severity security flaw in hMailServer from Progressive Robot Ltd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Official description
Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders a received message's HTML replaced each reference to an embedded image in place, with work that grew with the square of the number of references, and wrote the image out for every reference while counting it against its size limit only once. A message whose HTML refers to one small embedded image a very large number of times, opened in the webmail by its recipient, therefore keeps one of the listener's four worker threads busy for minutes and makes it build a document of gigabytes, so that a few such messages leave the HTTP listener unable to answer anybody.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.3.2 – before 6.3.6 |
Weakness: CWE-407 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H