CVE-2026-107579

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-107579

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107579.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-107579

Published

2026-10-08T11:47:06Z

Modified

2026-10-10T02:47:23Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Inefficient Algorithmic Complexity in hMailServer

Details

Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery by sending messages, when bounce processing or complaint processing is enabled or a mailing list is managed by the server (none is by default). The readers of incoming delivery status notifications (RFC 3464) and abuse feedback reports (RFC 5965) removed the blank lines at the start of the returned headers part two bytes at a time, copying the rest of the part each time, so their work grew with the square of the number of blank lines. A message shaped like such a report, whose headers part begins with a very large number of blank lines within the reader's 2 MB limit, keeps a delivery thread busy for over a minute while it is delivered, and a few such messages a minute keep every delivery thread busy.

Database specific

{
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-407"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107579.json"
}

References

Affected packages

Git / gitlab.com/hmailserver/hmailserver

Affected ranges

Type

GIT

Repo

https://gitlab.com/hmailserver/hmailserver

Events

Introduced

51e2dbda08d6aa7fcda5a48f1af05221809f78be

Fixed

e3c448aa66fc310b74d076884d54fae951296915

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "6.3.4"
        },
        {
            "fixed": "6.3.6"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v6.*

v6.3.4

v6.3.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107579.json"