CVE-2026-107576
- Source
- https://cve.org/CVERecord?id=CVE-2026-107576
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107576.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-107576
- Published
- 2026-10-08T11:46:56Z
- Modified
- 2026-10-10T02:47:22Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Inefficient Algorithmic Complexity in hMailServer
- Details
-
Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the mail services unavailable by sending a message. Building the canonical header and choosing the header fields named in a signature's h= tag took time growing with the square of the message's header: the 'simple' canonicalisation prepended each continuation line of a folded field to the lines already gathered, and both canonicalisations searched the gathered fields from the bottom for each h= name and erased the match from the middle of the list. A message whose header holds very many fields, or a field folded over very many lines, with a DKIM-Signature the attacker signs for a domain they control, keeps a worker thread busy for tens of seconds per signature; up to ten signatures are evaluated per message by each of the DKIM and DMARC tests, on the threads that serve delivery and SMTP.
- Database specific
{ "cna_assigner": "GitLab", "cwe_ids": [ "CWE-407" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107576.json" }- References