Progressive Robot hMailServer up to 6.3.5 Bounce/Complaint Processing special elements in template engine

Summaryinfo

A vulnerability was found in Progressive Robot hMailServer up to 6.3.5. It has been declared as problematic. This vulnerability affects unknown code of the component Bounce/Complaint Processing. Executing a manipulation can lead to special elements in template engine. This vulnerability is registered as CVE-2026-107579. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Progressive Robot hMailServer up to 6.3.5. It has been declared as problematic. This vulnerability affects some unknown processing of the component Bounce/Complaint Processing. The manipulation with an unknown input leads to a special elements in template engine vulnerability. The CWE definition for the vulnerability is CWE-1336. The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine. As an impact it is known to affect availability. CVE summarizes:

Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery by sending messages, when bounce processing or complaint processing is enabled or a mailing list is managed by the server (none is by default). The readers of incoming delivery status notifications (RFC 3464) and abuse feedback reports (RFC 5965) removed the blank lines at the start of the returned headers part two bytes at a time, copying the rest of the part each time, so their work grew with the square of the number of blank lines. A message shaped like such a report, whose headers part begins with a very large number of blank lines within the reader's 2 MB limit, keeps a delivery thread busy for over a minute while it is delivered, and a few such messages a minute keep every delivery thread busy.

The advisory is available at gitlab.com. This vulnerability was named CVE-2026-107579 since 10/08/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1221 by the MITRE ATT&CK project.

Upgrading to version 6.3.6 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Mail Server Software

Vendor

• Progressive Robot

Name

• hMailServer

Version

• 6.3.0
• 6.3.1
• 6.3.2
• 6.3.3
• 6.3.4
• 6.3.5

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion