CVE-2026-107582 Inefficient Algorithmic Complexity in hMailServer
Remote unauthenticated attackers can cause denial of service in hMailServer by sending HTML-only messages with many entity references, exhausting worker threads.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-107582?
CVE-2026-107582 is a medium-severity denial of service vulnerability in Progressive Robot Ltd hMailServer, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. To show a snippet of each message in a folder's message list, the server decoded the character entity references of a message that has an HTML part and no text part with a string replacement whose work grew with the square of their number. A received HTML-only message holding a very large number of entity references therefore keeps one of the listener's four worker threads busy for minutes or longer each time the recipient's webmail lists the folder, without the message being opened, so that a few such listings leave the HTTP listener unable to answer anybody. The IMAP PREVIEW response read such text the same way, holding an IMAP thread for each client that asks for the preview of such a message. The flaw is in the server's shared string class, whose replace and remove both ran in quadratic time.
Weakness: CWE-407
Which versions are affected by CVE-2026-107582?
How do I fix CVE-2026-107582?
No fix has been published for CVE-2026-107582 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-107582 being exploited?
There is no known exploitation of CVE-2026-107582 in the wild and no public exploit code.
Sources
Also known as GHSA-fh2m-q9cx-5h7c.