CVE-2026-107569: Unchecked Input for Loop Condition in hMailServer
Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mail. The server bounds the mail it generates in response to a message - a rule forward, reply or copy, an account forward, a Sieve redirect, vacation or notify, a bounce, an out-of-office reply - by a counter it carries in the message's X-hMailServer-LoopCount header, and makes no more once the counter reaches the configured rule loop limit (5 by default); that is what ends a forwarding or auto-reply cycle in a bounded number of hops. X-hMailServer-LoopCount is an ordinary header that is not stripped from mail arriving from outside, and the server read it with a signed conversion and no validation, so a count below zero passed every test against the limit: a sender who sets X-hMailServer-LoopCount to a negative value, or on the Linux builds to a value above the 32-bit signed range that the conversion wraps to a negative one, lifts the bound, and a message that enters a generated-mail cycle then loops up to about two thousand million times, each hop a queued message and a delivery, filling the queue and disk and stopping mail service. The Sieve notify action (from 6.2.22) consulted no limit at all, and its increment of the count could overflow a signed integer; and an account could reset the counter on its own mail through a Sieve editheader of the header (from 6.2.22) or a rule Set header value action (all versions) ahead of a forward or redirect.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hMailServerto a version that resolves this vulnerability.Fixed in 6.3.7 - Configuration
Keep ManageSieveServerPort=0 and RestApiPort=0 where the REST API is not needed, closing the Sieve and REST API script surfaces to accounts.
hMailServer ManageSieveServerPort and RestApiPort = 0 - Compensating control
Reduce forwarding and auto-reply arrangements that can feed one another, and review active Sieve scripts and account rules for a notify to the account's own address or edits to X-hMailServer-LoopCount.
- Compensating control
Watch the mail queue for messages generated far past the configured loop limit.
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An unauthenticated remote sender must be able to submit a message with a negative X-hMailServer-LoopCount value and cause it to enter a generated-mail cycle. Relevant generated-mail paths include rules that forward, reply, or copy mail; account forwarding; Sieve redirect, vacation, or notify actions; bounces; and out-of-office replies.
Does the default loop-limit setting protect affected servers?
No. The default rule loop limit is 5, but a negative loop-count value passes the comparisons against that limit and removes the intended bound on generated-mail hops.
Are Linux builds affected differently?
On Linux builds, an attacker can use either a negative value or a value above the 32-bit signed range that wraps to a negative value during conversion. The resulting cycle can generate roughly two billion queued deliveries, potentially filling the queue and disk and stopping mail service.