CVE-2026-107574

7.5 HIGH

Published 2026-10-08 · Updated 2026-10-08

AI risk analysis

Summary: The Progressive Robot hMailServer has an inefficient JSON reader that causes quadratic time complexity when processing JSON objects with duplicate member names, allowing remote attackers to crash the mail service by sending specially crafted TLS-RPT reports or using the webmail REST API.
Exploitability: Exploitation is relatively easy as attackers only need to send a crafted TLS-RPT report to a hosted domain's report mailbox or use the webmail REST API without authentication, with no additional preconditions required.
Blast radius: The impact is significant as the server becomes completely unresponsive for over an hour per malicious report, halting all mail delivery including local and outbound messages, affecting all users on the affected server.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to version 2.590 or later to fix the inefficient JSON reader algorithm that causes O(N^2) processing time for JSON objects with duplicate member names.

mailjsondos

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unavailable. Reading a JSON object kept the first of each duplicated member name by searching the members already read, so an object of N distinct member names cost O(N^2): 1 MB took 8.9 seconds and 4 MB took 300 seconds against the affected code. A remote attacker reaches the reader without an account by mailing a crafted TLS-RPT report (up to 16 MB after decompression) to a hosted domain's published report mailbox, which is read on a delivery thread; a few such reports hold every delivery thread (ten by default), so the server delivers no mail, local or outbound, for over an hour per report. A signed-in account reaches the same 16 MB body through the webmail's own REST routes, holding the REST API's own worker threads. Where no report mailbox is configured, the unauthenticated REST sign-in routes that read a JSON body are capped at 64 KB and are not affected.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-407

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.