CVE-2026-107585 Allocation of Resources Without Limits or Throttling in hMailServer
Remote unauthenticated attackers can exhaust pending sign-in tables in hMailServer, causing denial of service for single sign-on and passkey authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107585?
CVE-2026-107585 is a medium-severity denial of service vulnerability in Progressive Robot Ltd hMailServer, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in challenge are reached without authentication and stored pending state in bounded tables that dropped their oldest entry when full, whoever had started it. An attacker who starts sign-ins a few times a second (about a hundred a second for passkeys) pushes every other user's pending sign-in out of the table before that user's browser returns, denying single sign-on and passkey sign-in for as long as the requests continue.
Weakness: CWE-770
Which versions are affected by CVE-2026-107585?
How do I fix CVE-2026-107585?
No fix has been published for CVE-2026-107585 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-107585 being exploited?
There is no known exploitation of CVE-2026-107585 in the wild and no public exploit code.
Sources
Also known as GHSA-ff4v-mg5q-r7g9.