CVE-2026-107576

Summary

The Progressive Robot hMailServer has an inefficient algorithm in its DKIM and ARC signature verification that causes excessive CPU usage when processing messages with many header fields or folded lines. This allows a remote attacker to perform a denial-of-service attack by sending specially crafted messages that keep worker threads busy for tens of seconds per signature.

Exploitability

Exploitation is relatively straightforward as it requires only sending a message with a DKIM signature for a controlled domain, but the attack is most effective when the message contains many header fields or folded lines to maximize the computational overhead.

Blast radius

The impact could be significant across all email services using hMailServer 6.0.0 through 6.3.5, as the DoS condition affects worker threads handling delivery and SMTP connections, potentially making the mail service unavailable to legitimate users.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to hMailServer version 6.4.0 or later to address the inefficient algorithmic complexity in DKIM and ARC signature verification.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.