Vulnerability · Published Oct 8, 2026 · Assigned by GitLab
CVE-2026-107585Allocation of Resources Without Limits or Throttling in hMailServer
Medium 5.3
In plain English
A medium-severity resource allocation without limits in hMailServer from Progressive Robot Ltd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Official description
Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in challenge are reached without authentication and stored pending state in bounded tables that dropped their oldest entry when full, whoever had started it. An attacker who starts sign-ins a few times a second (about a hundred a second for passkeys) pushes every other user's pending sign-in out of the table before that user's browser returns, denying single sign-on and passkey sign-in for as long as the requests continue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.3.4 – before 6.3.6 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L