CVE-2026-107579

7.5 HIGH

Published 2026-10-08 · Updated 2026-10-08

AI risk analysis

Summary: The hMailServer software has an inefficient algorithm that causes excessive CPU usage when processing bounce and complaint messages with many leading blank lines in headers, potentially leading to denial of service by keeping delivery threads busy for extended periods.
Exploitability: Exploitation is straightforward for unauthenticated remote attackers who can send specially crafted messages to the server, requiring only basic mail sending capabilities and no authentication or special privileges.
Blast radius: The impact could affect all email delivery on the server, potentially causing widespread delays or complete failure of message delivery when multiple malicious messages are sent in quick succession.
Detection: Monitor for sustained high CPU usage on mail delivery threads, particularly during periods of increased email traffic, and look for delivery thread blocking patterns in server logs indicating prolonged processing times for incoming messages.
Prioritized remediation: Upgrade to hMailServer version 6.3.6 or later which contains the fix for this algorithmic complexity issue.

denial-of-servicemail-serveralgorithmic-complexity

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery by sending messages, when bounce processing or complaint processing is enabled or a mailing list is managed by the server (none is by default). The readers of incoming delivery status notifications (RFC 3464) and abuse feedback reports (RFC 5965) removed the blank lines at the start of the returned headers part two bytes at a time, copying the rest of the part each time, so their work grew with the square of the number of blank lines. A message shaped like such a report, whose headers part begins with a very large number of blank lines within the reader's 2 MB limit, keeps a delivery thread busy for over a minute while it is delivered, and a few such messages a minute keep every delivery thread busy.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-407

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.