CVE-2026-107575: Inefficient Algorithmic Complexity in hMailServer
Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels from the left; the server did this by removing one label at a time and copying the rest of the name each time, so the work grew with the square of the expansion. An attacker who publishes an SPF record for a domain they control, with a mechanism whose domain-spec expands through macros to a name far longer than 253 characters, makes the SPF check of a message from that domain take several seconds. The expansion is bounded by SPF's own per-term and per-macro limits, so the loss of availability is partial.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progressive Robot hMailServerto a version that resolves this vulnerability.Fixed in 6.3.6 - Configuration
Turn SPF checking off until upgrading to hMailServer 6.3.6.
hMailServer SPF checking = off
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Progressive Robot hMailServer versions 6.3.4 and 6.3.5 are identified as affected. Exposure occurs when the server performs an SPF check for mail claiming to come from an attacker-controlled domain.
What does an attacker need to do to trigger the resource consumption?
The attacker must publish a crafted SPF record for a domain they control and send or cause processing of a message from that domain. The SPF record needs a mechanism whose domain-spec uses macro expansion to produce a name much longer than 253 characters.
What is the practical impact on the mail server?
A crafted SPF check can consume several seconds of worker-thread time. Availability impact is partial because SPF per-term and per-macro limits bound the expansion.
What version addresses the issue?
The provided release reference identifies hMailServer v6.3.6. The affected versions listed are 6.3.4 and 6.3.5.