CVE-2026-107580: Inefficient Algorithmic Complexity in hMailServer
Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the IMAP, SMTP and POP3 services, or the webmail, unavailable by sending a message. The server unfolded a decoded header value by finding each line break from the end of the value and removing it, moving the rest of the value each time, so its work grew with the square of the number of line breaks, and an RFC 2047 encoded word may decode to any number of them. A received message whose Subject or other header field holds such a value keeps a worker thread busy for minutes or longer each time the value is read: when the recipient's IMAP client searches, sorts or threads the folder by a header, when the webmail lists the folder, and, where configured, when a rule tests a header, a spam tag is added to the Subject or an abuse report is read during delivery. The IMAP worker threads are shared with SMTP and POP3, so a few such messages stop those services responding. The server's reading of a message header from its file also searched everything read so far after each 4,000 bytes, costing seconds for a header of tens of megabytes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hMailServerto a version that resolves this vulnerability.Fixed in 6.3.6 - Configuration
Lower the maximum message size to bound the processing cost of malicious headers.
hMailServer maximum message size = lower - Configuration
Keep the REST listener off by setting RestApiPort to 0.
hMailServer REST listener RestApiPort = 0 - Operational
Remove such a message over POP3.
Event History
Frequently Asked Questions
Which deployments are within the stated affected version range?
Progressive Robot hMailServer versions 6.0.0 through 6.3.5 are identified as affected. The provided data cites a v6.3.6 release reference, but does not explicitly state remediation guidance.
What does an attacker need to do to cause service disruption?
A remote attacker does not need authentication, but must be able to send a message containing a specially constructed RFC 2047-decoded value with many line breaks in a Subject or other header field. Exploitation requires user interaction because the costly processing occurs when the header is read.
When can a malicious message consume worker threads?
Processing can be triggered when an IMAP client searches, sorts, or threads a folder by a header, when webmail lists the folder, or during delivery if configured rules test headers, add a spam tag to the Subject, or read an abuse report. A few such messages can prevent IMAP, SMTP, and POP3 from responding because those services share IMAP worker threads.