{"id":"CVE-2026-107574","revision":"53e998694b604db288b24a25965fc582","records":[{"revision":"53e998694b604db288b24a25965fc582","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107574","aliases":[],"title":"Inefficient Algorithmic Complexity in hMailServer","description":"Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unavailable. Reading a JSON object kept the first of each duplicated member name by searching the members already read, so an object of N distinct member names cost O(N^2): 1 MB took 8.9 seconds and 4 MB took 300 seconds against the affected code. A remote attacker reaches the reader without an account by mailing a crafted TLS-RPT report (up to 16 MB after decompression) to a hosted domain's published report mailbox, which is read on a delivery thread; a few such reports hold every delivery thread (ten by default), so the server delivers no mail, local or outbound, for over an hour per report. A signed-in account reaches the same 16 MB body through the webmail's own REST routes, holding the REST API's own worker threads. Where no report mailbox is configured, the unauthenticated REST sign-in routes that read a JSON body are capped at 64 KB and are not affected.","state":0,"publishedAt":"2026-10-08T11:46:26.206+00:00","modifiedAt":"2026-10-08T14:15:58.279+00:00","affected":[{"ecosystem":"Vendor product","name":"hMailServer","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Progressive Robot Ltd\",\n                    \"product\": \"hMailServer\",\n                    \"repo\": \"https://gitlab.com/hmailserver/hmailserver\",\n                    \"versions\": [\n                        {\n                            \"version\": \"6.2.28\",\n                            \"status\": \"affected\",\n                            \"lessThan\": \"6.3.6\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://gitlab.com/hmailserver/hmailserver/-/work_items/76","https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107574","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107574","identifiers":["CVE-2026-107574"]},"retained":false,"historicalAffected":[]}],"coverage":[]}