CVE-2026-107576
- Source
- https://cve.org/CVERecord?id=CVE-2026-107576
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107576.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-107576
- Published
- 2026-10-08T11:46:56Z
- Modified
- 2026-10-28T02:31:12Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Inefficient Algorithmic Complexity in hMailServer
- Details
-
Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the mail services unavailable by sending a message. Building the canonical header and choosing the header fields named in a signature's h= tag took time growing with the square of the message's header: the 'simple' canonicalisation prepended each continuation line of a folded field to the lines already gathered, and both canonicalisations searched the gathered fields from the bottom for each h= name and erased the match from the middle of the list. A message whose header holds very many fields, or a field folded over very many lines, with a DKIM-Signature the attacker signs for a domain they control, keeps a worker thread busy for tens of seconds per signature; up to ten signatures are evaluated per message by each of the DKIM and DMARC tests, on the threads that serve delivery and SMTP.
- Database specific
{ "cna_assigner": "GitLab", "cwe_ids": [ "CWE-407" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107576.json" }- References
Affected packages
Git / gitlab.com/hmailserver/hmailserver
Affected ranges
- Type
- GIT
- Repo
- https://gitlab.com/hmailserver/hmailserver
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "6.0.0" }, { "fixed": "6.3.6" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "6.0.0" }, { "last_affected": "6.3.5" } ], "source": "DESCRIPTION" } ] }