hMailServer CVE-2026-107569

Exploitation requires the targeted account or domain to have a mail-generating feature enabled that can form a cycle - a rule forward/reply/copy, an account forward, a Sieve redirect/vacation/notify, a bounce, or an out-of-office reply - because the loop only runs when the server generates mail in response to the attacker's message. The attacker then injects the X-hMailServer-LoopCount header (not stripped from external mail) with a negative value, or on Linux builds a value above the 32-bit signed maximum that wraps negative, to lift the default loop limit of 5. Limiting factors: if no forwarding/auto-reply/redirect feature is configured no cycle forms; the signed-integer-wrap variant is specific to Linux builds (negative-value injection works on all affected builds); the Sieve notify no-limit variant applies from 6.2.22 onward; and attacker-controlled counter reset via Sieve editheader applies from 6.2.22 while the rule Set-header-value reset applies to all versions.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a remote, unauthenticated, low-complexity attack with pure availability impact - there is no confidentiality or integrity loss, so despite the 'High' severity this is a denial-of-service, not code execution. The 'Buffer Overflow' tag in the input is misleading: the root cause is CWE-606 (unchecked input for a loop condition) combined with a signed integer conversion/overflow, not memory corruption. No EPSS score, CISA KEV listing, SSVC decision data, or POC is present in the provided intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Exploitation is further gated by a victim-side precondition - the targeted account/domain must have a mail-generating feature (forwarding rule, reply/copy, Sieve redirect/notify/vacation, bounce, or out-of-office) configured so a cycle can form - which tempers the otherwise AC:L/PR:N profile. Net assessment: a real but moderate operational risk (self-inflicted mail outage, queue/disk exhaustion) that should be patched, rather than a widely-weaponizable critical flaw; EPSS and exploitation-status signals are missing and should be monitored.

A remote attacker sends an ordinary email to an hMailServer account that has forwarding or an auto-reply configured, setting the X-hMailServer-LoopCount header to a negative value (or, on Linux builds, a value above the 32-bit signed range that wraps negative). Because the header is not stripped from externally-arriving mail and is read with an unvalidated signed conversion, the loop-count bound is bypassed and the resulting generated-mail cycle iterates up to roughly two billion times, each hop queuing a message and a delivery. No public exploit code is identified at time of analysis, but the attack requires only a single crafted message and no authentication.