CVE-2026-107577: Loop with Unreachable Exit Condition ('Infinite Loop') in hMailServer
Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote unauthenticated attacker to make the mail services unavailable by sending a message. Removing a MIME header parameter whose value is empty and directly followed by a semicolon (for example a Content-Disposition with 'filename=a.bat; filename=;') entered a loop that never terminates, holding a worker thread at full load until the server is restarted; this is reached when the attachment blocker renames a blocked attachment or a filename is set over the REST API. Separately, decoding a header field that holds many RFC 2047 encoded words of an encoding other than base64 or quoted-printable, removing a parameter with many RFC 2231 continuations, and deleting many header fields of one name each took time growing with the square of the message, on the small thread pools that serve IMAP, SMTP and POP3 connections, delivery and the REST API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progressive Robot hMailServerto a version that resolves this vulnerability.Fixed in 6.3.6 - Compensating control
Lower the maximum message size to bound the quadratic MIME-processing paths.
- Operational
Restart the hMailServer service to end any hung worker thread.
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote, unauthenticated attacker can trigger the denial of service by sending a crafted message. The affected processing paths use small thread pools serving IMAP, SMTP, POP3, delivery, and the REST API, so service availability can be affected.
What message content triggers the non-terminating loop?
The loop is triggered when a MIME header parameter with an empty value is immediately followed by a semicolon is removed, such as a Content-Disposition value containing "filename=a.bat; filename=;". The vulnerable removal path is reached when the attachment blocker renames a blocked attachment or when a filename is set through the REST API.
What is the operational impact of a successful attack?
The non-terminating loop holds a worker thread at full load until the server is restarted, making mail services unavailable. Other crafted headers can cause processing time to grow quadratically with message size, potentially exhausting the small connection and API thread pools.
Which versions are affected?
Progressive Robot hMailServer 6.0.0 through 6.3.5 are affected. The provided release reference identifies version 6.3.6.