EUVD-2026-94862
GHSA-6877-qwxc-rh5c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Unauthenticated attacker emails a crafted header (AV:N/AC:L/PR:N); impact triggers on read/processing of the header (UI:R); availability-only DoS (A:H, C:N/I:N).
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
4DescriptionCVE.org
Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the IMAP, SMTP and POP3 services, or the webmail, unavailable by sending a message. The server unfolded a decoded header value by finding each line break from the end of the value and removing it, moving the rest of the value each time, so its work grew with the square of the number of line breaks, and an RFC 2047 encoded word may decode to any number of them. A received message whose Subject or other header field holds such a value keeps a worker thread busy for minutes or longer each time the value is read: when the recipient's IMAP client searches, sorts or threads the folder by a header, when the webmail lists the folder, and, where configured, when a rule tests a header, a spam tag is added to the Subject or an abuse report is read during delivery. The IMAP worker threads are shared with SMTP and POP3, so a few such messages stop those services responding. The server's reading of a message header from its file also searched everything read so far after each 4,000 bytes, costing seconds for a header of tens of megabytes.
AnalysisAI
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated sender stall the IMAP, SMTP, POP3 and webmail services by delivering a single message whose header field carries an RFC 2047 encoded word that decodes to a very large number of line breaks. The decoder unfolds such a value quadratically, so each read of the poisoned header can occupy a shared worker thread for minutes or longer; because IMAP worker threads are shared with SMTP and POP3, a handful of messages can render the mail services unresponsive. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | A remote unauthenticated attacker only needs to deliver one email to a recipient on the hMailServer (SMTP accepts the message) whose Subject or other header field carries an RFC 2047 encoded word that decodes to many line breaks. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 base score is 6.5 (MEDIUM) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - a pure availability (denial-of-service) flaw reachable over the network by an unauthenticated attacker with low attack complexity, but gated by UI:R (a victim action or configured rule must read the poisoned header). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to hMailServer 6.3.6, the vendor-released fix that removes the quadratic unfold and the rescanning header reader (release notes: https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6; tracking item: https://gitlab.com/hmailserver/hmailserver/-/work_items/69). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allShare
External POC / Exploit Code
Leaving vuln.today