EUVD-2026-94859
GHSA-6pj8-9c42-v5rp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated attacker sends a single crafted SMTP message (AV:N/AC:L/PR:N/UI:N); impact is thread-pool exhaustion causing service outage only, so C:N/I:N/A:H, scope unchanged.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
4DescriptionCVE.org
Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the mail services unavailable by sending a message. Building the canonical header and choosing the header fields named in a signature's h= tag took time growing with the square of the message's header: the 'simple' canonicalisation prepended each continuation line of a folded field to the lines already gathered, and both canonicalisations searched the gathered fields from the bottom for each h= name and erased the match from the middle of the list. A message whose header holds very many fields, or a field folded over very many lines, with a DKIM-Signature the attacker signs for a domain they control, keeps a worker thread busy for tens of seconds per signature; up to ten signatures are evaluated per message by each of the DKIM and DMARC tests, on the threads that serve delivery and SMTP.
AnalysisAI
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail delivery and SMTP service by sending a single crafted message. The root cause is inefficient algorithmic complexity (CWE-407) in inbound DKIM and ARC signature verification: assembling the canonical header and resolving the header names listed in a signature's h= tag grows quadratically with header size, so a message with very many header fields - or one field folded over very many continuation lines - holds a worker thread busy for tens of seconds per signature, and up to ten signatures are evaluated per message by both the DKIM and DMARC tests on the threads that serve delivery and SMTP. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The server must perform inbound DKIM and/or ARC signature verification on received mail - hMailServer evaluates these as part of DMARC/DKIM anti-spoofing checks on the SMTP/delivery path, so the condition is met in typical anti-spam configurations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, realistic availability risk rather than an inflated high-CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to hMailServer v6.3.6, the vendor-released version that removes the quadratic header-canonicalization behavior, available from https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6, with the underlying issue tracked at https://gitlab.com/hmailserver/hmailserver/-/work_items/73. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether any hMailServer 6.0.0 through 6.3.5 instances are internet-facing or reachable by untrusted networks, restrict SMTP access to known mail relays and trusted networks via firewall or ACL rules, enable verbose logging and alerting on delivery-queue depth and worker-thread saturation, and review vendor guidance for interim rate-limiting or message-size/header-count restrictions at the gateway. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmailserver
View allArbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticate
Cross-site scripting in Progressive Robot hMailServer 6.3.2 through 6.3.5 can let a remote, unauthenticated attacker exe
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any loc
Heap-based buffer overflow in hMailServer 6.0.0 through 6.3.3 on Windows lets a local interactive user - with no hMailSe
Local privilege escalation in hMailServer 6.0.0 through 6.3.5 on Windows allows an authenticated local user-one with an
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 on Linux allows an attacker who already has
Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail del
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first inst
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5
DNS rebinding against Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote, unauthenticated attacker to bru
Outbound SMTP delivery in Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when DANE (RFC 7672) validation c
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allShare
External POC / Exploit Code
Leaving vuln.today