Progressive Robot hMailServer up to 6.3.5 Browser Session Table allocation of resources

Summaryinfo

A vulnerability labeled as problematic has been found in Progressive Robot hMailServer up to 6.3.5. Affected by this issue is some unknown functionality of the component Browser Session Table. Such manipulation leads to allocation of resources. This vulnerability is referenced as CVE-2026-107586. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Progressive Robot hMailServer up to 6.3.5. Affected by this issue is an unknown part of the component Browser Session Table. The manipulation with an unknown input leads to a allocation of resources vulnerability. Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. Impacted is availability. CVE summarizes:

Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote authenticated user to end other users' sessions. The table of browser sessions, shared by every account, the server administrator and support sessions, dropped its least recently used session whenever it was full, whoever it belonged to, and placed no limit on how many sessions one account could hold. A user who repeatedly signs in with their own mailbox password can therefore keep the table full and sign out every webmail and administration session that is idle for more than a short time, for as long as they continue.

The advisory is shared for download at gitlab.com. This vulnerability is handled as CVE-2026-107586 since 10/08/2026. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 6.3.6 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-95038). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Mail Server Software

Vendor

• Progressive Robot

Name

• hMailServer

Version

• 6.3.0
• 6.3.1
• 6.3.2
• 6.3.3
• 6.3.4
• 6.3.5

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion