CVE-2026-107582 in hMailServer
Summary
by MITRE • 10/08/2026
Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. To show a snippet of each message in a folder's message list, the server decoded the character entity references of a message that has an HTML part and no text part with a string replacement whose work grew with the square of their number. A received HTML-only message holding a very large number of entity references therefore keeps one of the listener's four worker threads busy for minutes or longer each time the recipient's webmail lists the folder, without the message being opened, so that a few such listings leave the HTTP listener unable to answer anybody. The IMAP PREVIEW response read such text the same way, holding an IMAP thread for each client that asks for the preview of such a message. The flaw is in the server's shared string class, whose replace and remove both ran in quadratic time.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified as CVE-2019-18745 represents a significant denial-of-service risk within Progressive Robot hMailServer versions 6.3.3 through 6.3.5. This flaw stems from inefficient algorithmic complexity in the server's core string handling mechanisms, specifically affecting both the REST API and the IMAP PREVIEW response functionality. The issue is rooted in the implementation of a shared string class used by the application to process text data. When performing operations such as replace or remove on strings containing numerous character entity references, the algorithm exhibits quadratic time complexity relative to the number of entities present. This means that as the size of the input increases linearly, the computational effort required grows exponentially, leading to severe performance degradation under specific conditions.
The operational impact is most pronounced when a remote unauthenticated attacker sends an HTML-only email containing a very large number of character entity references to a target mailbox. To display message snippets in folder lists within webmail or via IMAP previews, hMailServer attempts to decode these entities by performing string replacements on the content. Because the underlying algorithm processes each replacement operation with quadratic complexity, decoding a message with thousands of such entities can consume significant CPU resources for minutes at a time. Crucially, this processing occurs even if the recipient never opens or reads the email; it is triggered merely by listing the folder containing the malicious message in webmail or requesting an IMAP preview.
This resource exhaustion directly impacts server availability and stability. hMailServer utilizes four worker threads to handle incoming connections and requests. When a single user's client triggers the inefficient decoding process, one of these limited threads becomes occupied for an extended period. If multiple users list folders containing such crafted messages simultaneously, or if a single persistent attacker repeatedly forces folder listings, all available worker threads can become saturated. Consequently, the HTTP listener responsible for serving webmail and administrative console requests loses its ability to accept new connections, effectively rendering the entire mail server unavailable to legitimate users. This constitutes a classic remote denial-of-service attack vector that requires no authentication credentials to exploit.
From a classification perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, specifically highlighting issues related to algorithmic complexity leading to resource exhaustion. In the context of the MITRE ATT&CK framework, this behavior is consistent with techniques used in Denial-of-Service attacks where an adversary aims to disrupt service availability by overwhelming system resources rather than compromising data confidentiality or integrity. The attack vector leverages standard email protocols and web interfaces, making it accessible to any remote actor without prior access privileges.
Mitigation strategies for this vulnerability primarily involve upgrading hMailServer to a version that includes the patched string handling logic with improved algorithmic efficiency. Until an upgrade is feasible, administrators should consider implementing network-level controls such as rate limiting on HTTP requests and IMAP connections to mitigate the impact of rapid folder listing or preview requests. Additionally, deploying email filtering solutions at the perimeter can help detect and block incoming messages that contain abnormally high counts of character entity references before they reach the hMailServer instance. Regular monitoring of server resource usage during peak times may also assist in identifying potential abuse patterns associated with this flaw.