CVE-2026-107580 in hMailServer
Summary
by MITRE • 10/08/2026
Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the IMAP, SMTP and POP3 services, or the webmail, unavailable by sending a message. The server unfolded a decoded header value by finding each line break from the end of the value and removing it, moving the rest of the value each time, so its work grew with the square of the number of line breaks, and an RFC 2047 encoded word may decode to any number of them. A received message whose Subject or other header field holds such a value keeps a worker thread busy for minutes or longer each time the value is read: when the recipient's IMAP client searches, sorts or threads the folder by a header, when the webmail lists the folder, and, where configured, when a rule tests a header, a spam tag is added to the Subject or an abuse report is read during delivery. The IMAP worker threads are shared with SMTP and POP3, so a few such messages stop those services responding. The server's reading of a message header from its file also searched everything read so far after each 4,000 bytes, costing seconds for a header of tens of megabytes.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in hMailServer versions 6.0.0 through 6.3.5 represents a critical inefficiency in algorithmic complexity related to the decoding and processing of message header fields. This flaw allows remote unauthenticated attackers to execute denial-of-service attacks against IMAP, SMTP, POP3 services, as well as the webmail interface. The core technical issue stems from an inefficient implementation when handling unfolded decoded header values. Specifically, the server processes these values by locating each line break starting from the end of the value and removing it while shifting the remainder of the string. This approach results in quadratic time complexity relative to the number of line breaks present in the input data. Since RFC 2047 encoded words can decode into an arbitrary number of such line breaks, attackers can craft malicious messages with excessively long or numerous header fields that trigger this inefficient processing path.
The operational impact of this vulnerability is severe due to the resource consumption involved. When a message containing these malformed headers is received, it causes worker threads to remain busy for minutes or even longer each time the header value is accessed. This occurs during various standard email operations such as when an IMAP client searches, sorts, or threads folders by specific headers, when the webmail interface lists folder contents, and potentially during rule-based processing like adding spam tags to subjects or reading abuse reports during delivery. Because hMailServer shares worker threads across multiple protocols including IMAP, SMTP, and POP3, the exhaustion of these threads by a few maliciously crafted messages effectively halts service availability for all connected users and services. This shared resource model means that an attack targeting one protocol can disrupt others simultaneously, amplifying the denial-of-service effect significantly beyond just the targeted connection point.
Additionally, there is a secondary inefficiency related to reading message headers from disk storage. The server searches through previously read data after every four thousand bytes during header parsing. This linear scan over accumulated data leads to significant latency for messages with large header sizes reaching tens of megabytes, adding seconds of processing time per access event. While this specific aspect contributes less directly to the immediate thread exhaustion compared to the decoding flaw, it further degrades overall server performance and responsiveness under load from maliciously sized headers.
From a classification perspective, this vulnerability aligns with CWE-400 Uncontrolled Resource Consumption, specifically highlighting inefficient algorithmic complexity as a root cause of resource exhaustion. In terms of attack vectors, it corresponds to MITRE ATT&CK technique T1499 Endpoint Denial of Service, where an attacker aims to degrade or disrupt the availability of targeted components by overwhelming system resources. The lack of authentication required for exploitation makes this particularly dangerous in environments where external access is permitted without strict input validation mechanisms.
Mitigation strategies should focus on immediate patching to upgrade hMailServer to a version that addresses these algorithmic inefficiencies. Administrators must ensure that the software vendor has released and deployed fixes that optimize header decoding logic, likely by replacing the quadratic complexity operations with more efficient string handling methods such as pre-allocation or reverse iteration without shifting. Furthermore, implementing input validation at the network perimeter can help filter out excessively large headers before they reach the application layer. Rate limiting on incoming connections and enforcing strict size limits on email headers are also recommended defensive measures to reduce exposure while patches are applied. Regular monitoring of server resource usage patterns can aid in early detection of such abuse attempts allowing for rapid response to potential denial-of-service events.