CVE-2026-107581
- Source
- https://cve.org/CVERecord?id=CVE-2026-107581
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107581.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-107581
- Published
- 2026-10-08T11:47:16Z
- Modified
- 2026-10-10T02:47:22Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Inefficient Algorithmic Complexity in hMailServer
- Details
-
Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the number of elements it names, and can be made to hold memory out of proportion to a command. The FETCH data-item parser normalised a BODY[] section with a case-insensitive string replacement that copied the whole item per occurrence and split the item list by repeatedly copying the remainder of the command; the server's case-insensitive search compared a needle afresh at every position, so a long SEARCH TEXT key over a message cost the product of the two lengths; SEARCH message sets and the saved-result marker ($), SORT criteria, HEADER.FIELDS name lists and UID ranges were each read once per message rather than once per command; and a FETCH naming a message's sections very many times read and held every section in memory before sending any. An IMAP command may continue past one line through non-synchronizing literals, so one command can reach about eleven megabytes. The IMAP worker threads are a small pool shared with SMTP and POP3, so a signed-in user sending such commands can make the IMAP, SMTP and POP3 services stop responding (CWE-407) and can consume excessive memory (CWE-400).
- Database specific
{ "cna_assigner": "GitLab", "cwe_ids": [ "CWE-407" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107581.json" }- References