EUVD-2026-94861
GHSA-7658-76c6-34x2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated message sending triggers quadratic parsing (AV:N/AC:L/PR:N/UI:N); availability-only impact (A:H, C/I:N); non-default-config precondition is not a base metric in 3.1.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
4DescriptionCVE.org
Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery by sending messages, when bounce processing or complaint processing is enabled or a mailing list is managed by the server (none is by default). The readers of incoming delivery status notifications (RFC 3464) and abuse feedback reports (RFC 5965) removed the blank lines at the start of the returned headers part two bytes at a time, copying the rest of the part each time, so their work grew with the square of the number of blank lines. A message shaped like such a report, whose headers part begins with a very large number of blank lines within the reader's 2 MB limit, keeps a delivery thread busy for over a minute while it is delivered, and a few such messages a minute keep every delivery thread busy.
AnalysisAI
Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail delivery by sending messages crafted to look like RFC 3464 delivery status notifications or RFC 5965 abuse feedback reports whose returned-headers part begins with a very large number of blank lines. The DSN and ARF readers strip leading blank lines two bytes at a time, copying the remainder of the part on each iteration, so processing cost grows with the square of the blank-line count; a single report-shaped message within the reader's 2 MB limit can occupy a delivery thread for over a minute, and a few such messages per minute can saturate every delivery thread. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the server have bounce processing OR complaint processing enabled, OR that it manage a mailing list - and the vendor explicitly states none of these is enabled by default, so a stock hMailServer 6.3.4/6.3.5 is NOT exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional availability risk, not a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to hMailServer 6.3.6 (vendor release at https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6, tracked as work item https://gitlab.com/hmailserver/hmailserver/-/work_items/70); this is a vendor-released patched version and removes the quadratic blank-line handling in the DSN and ARF readers, and it should be treated as the only complete remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
No vendor-released patch identified at time of analysis; within 24 hours, inventory all hMailServer instances to confirm whether they run version 6.3.4 or 6.3.5 and determine whether bounce processing, complaint processing, or mailing list management is enabled, and if any of these features are enabled and not strictly required, disable them immediately, while if they are required, apply inbound rate limiting and filtering for DSN/ARF messages with excessive leading blank lines in returned-headers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmailserver
View allArbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticate
Cross-site scripting in Progressive Robot hMailServer 6.3.2 through 6.3.5 can let a remote, unauthenticated attacker exe
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any loc
Heap-based buffer overflow in hMailServer 6.0.0 through 6.3.3 on Windows lets a local interactive user - with no hMailSe
Local privilege escalation in hMailServer 6.0.0 through 6.3.5 on Windows allows an authenticated local user-one with an
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 on Linux allows an attacker who already has
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first inst
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5
DNS rebinding against Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote, unauthenticated attacker to bru
Outbound SMTP delivery in Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when DANE (RFC 7672) validation c
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allShare
External POC / Exploit Code
Leaving vuln.today