Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

hMailServer may freeze and consume excessive memory

CVE-2026-107581 · published 27 days ago
Summary

The hMailServer mail system can get very slow and use too much memory when it processes certain email commands from a signed‑in user. This can cause the email, sending, and receiving services to stop responding. Update to the latest version from the vendor or apply the supplied patch, and consider limiting the size of client commands to prevent the problem.

What to do
  • Update progressive robot ltd hmailserver to version 6.3.6 or later.
Affected software
VendorProductAffected versions
progressive robot ltd hmailserver < 6.3.6
Original advisory text
Inefficient Algorithmic Complexity in hMailServer
Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the number of elements it names, and can be made to hold memory out of proportion to a command. The FETCH data-item parser normalised a BODY[] section with a case-insensitive string replacement that copied the whole item per occurrence and split the item list by repeatedly copying the remainder of the command; the server's case-insensitive search compared a needle afresh at every position, so a long SEARCH TEXT key over a message cost the product of the two lengths; SEARCH message sets and the saved-result marker ($), SORT criteria, HEADER.FIELDS name lists and UID ranges were each read once per message rather than once per command; and a FETCH naming a message's sections very many times read and held every section in memory before sending any. An IMAP command may continue past one line through non-synchronizing literals, so one command can reach about eleven megabytes. The IMAP worker threads are a small pool shared with SMTP and POP3, so a signed-in user sending such commands can make the IMAP, SMTP and POP3 services stop responding (CWE-407) and can consume excessive memory (CWE-400).
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-407Inefficient Algorithmic Complexity
Timeline
Published8 Oct 2026
Updated4 Nov 2026
First seen8 Oct 2026
Sources
CVE-2026-107581 · NVD
CVE-2026-107581 · MITRE
CVE-2026-107581 · OSV
Track software like this
Free during beta