CVE-2026-107583 Inefficient Algorithmic Complexity in hMailServer
Remote unauthenticated attackers can cause denial of service in hMailServer by sending crafted messages that trigger inefficient algorithmic complexity in the webmail REST API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-107583?
CVE-2026-107583 is a medium-severity denial of service vulnerability in Progressive Robot Ltd hMailServer, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders a received message's HTML replaced each reference to an embedded image in place, with work that grew with the square of the number of references, and wrote the image out for every reference while counting it against its size limit only once. A message whose HTML refers to one small embedded image a very large number of times, opened in the webmail by its recipient, therefore keeps one of the listener's four worker threads busy for minutes and makes it build a document of gigabytes, so that a few such messages leave the HTTP listener unable to answer anybody.
Weakness: CWE-407
Which versions are affected by CVE-2026-107583?
How do I fix CVE-2026-107583?
No fix has been published for CVE-2026-107583 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-107583 being exploited?
There is no known exploitation of CVE-2026-107583 in the wild and no public exploit code.
Sources
Also known as GHSA-2vm3-8w38-9p34.