EUVD-2026-95038
GHSA-q3hq-6rq3-6px5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to REST API with own mailbox
-
ExploitRepeatedly sign in to flood shared session table
-
ExecutionLRU eviction drops others' sessions
-
ImpactAdmin/webmail users forcibly logged out (availability loss)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to hold valid credentials for any hMailServer mailbox (PR:L, confirmed by CVSS) and network reachability to the REST API endpoint on an instance running 6.2.28 through 6.3.5. The specific precondition is the design of the single browser-session table shared across all accounts plus administrator and support sessions, which uses least-recently-used eviction with no per-account session cap. Limiting factors: the attacker must authenticate (not unauthenticated), impact is confined to availability of other users' sessions (idle sessions are the ones evicted), there is no code execution or data disclosure, and the condition is cleared by upgrading to 6.3.6. |
| Impact | This is a genuinely low-priority issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) correctly caps severity at 4.3 Medium: the only impact is availability (A:L), with zero confidentiality or integrity effect, and exploitation requires a valid, authenticated mailbox account (PR:L). All exploitation signals point the same direction and do not conflict: there is no CISA KEV listing, no public proof-of-concept referenced, and the only provided reference is the vendor's own 6.3.6 release and work-item tracker. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The practical ceiling is a session-eviction nuisance - a legitimate low-privileged user can repeatedly log in to keep a shared, globally-scoped session table full, forcibly logging out idle webmail and admin sessions. This is an abuse-of-function denial of service by an insider/tenant rather than a remote-code or data-exposure flaw, so it warrants routine patching to 6.3.6 rather than emergency response. |
| Exploit ScenarioDerived | A low-privileged user with a valid hMailServer mailbox repeatedly authenticates to the REST API using their own password, each login consuming a slot in the shared browser-session table. Because the table evicts its least-recently-used entry regardless of owner and imposes no per-account cap, the attacker keeps it saturated and continuously evicts other users', support, and administrator sessions that have been idle for more than a short period. No public exploit code is identified at time of analysis; the attack requires only scripted repeated logins with legitimate credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Session exhaustion in Progressive Robot hMailServer 6.2.28 through 6.3.5 lets any user who holds valid credentials for a single mailbox repeatedly log in and keep the server's shared browser-session table full, causing the least-recently-used eviction logic to terminate other users' webmail and administration sessions, including those of the server administrator and support staff. Because the table is global rather than per-account and imposes no cap on how many concurrent sessions one account may hold, the attacker does not need elevated privileges or special access - only network reachability to the REST API endpoint (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, assessed as an authenticated-remote availability issue). Impact is limited to denial of service against idle sessions, with no code execution, data disclosure, or integrity impact, and no public exploit identified at time of analysis; upgrading to hMailServer 6.3.6 clears the condition.
RemediationAI
Upgrade to hMailServer 6.3.6, the vendor-released fix (https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6; change tracked in https://gitlab.com/hmailserver/hmailserver/-/work_items/62), which removes the shared-session-table behaviour that permits cross-account eviction. If the upgrade cannot be scheduled immediately, the most effective compensating control is to restrict network access to the REST API endpoint - bind it to localhost or a management VLAN, or place it behind an authenticating reverse proxy - accepting that this blocks remote webmail users who rely on that API. A second option is to front the endpoint with a reverse proxy or WAF rule that rate-limits authentication and session-creation requests per source or per mailbox and caps concurrent sessions per account, which raises the effort needed to keep the table saturated but adds latency and operational complexity and can false-positive on shared NAT egress or clients that open many tabs. Shortening the idle session timeout reduces the window in which a legitimate session can be evicted but forces users to re-authenticate more often, and temporarily disabling or not exposing the administrative web interface limits the blast radius on administrator and support sessions at the cost of out-of-band management. None of these controls remove the underlying defect, so treat the upgrade to 6.3.6 as the required fix and the workarounds as interim risk reduction.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-770 (Allocation of Resources Without Limits or Throttling) defect in the REST API's browser-session management layer of hMailServer, a Windows mail server whose webmail and administration interfaces are exposed through that API. Rather than partitioning sessions per account, the server keeps one process-wide table of browser sessions shared by ordinary mailbox users, the administrator, and support logins. When that table reaches capacity, the implementation evicts the least-recently-used entry regardless of its owner, and it does not enforce any per-account ceiling on session creation. The two design choices compound: an attacker with one valid mailbox credential can open sessions fast enough to keep the table saturated, and because eviction is LRU-based, any other session that has been idle for more than a brief interval is pushed out. This is purely a resource-management and session-lifecycle weakness in the REST API, not a memory-safety, authentication-bypass, or injection bug; there is no path to privilege escalation, credential theft, or mail data access through it. Per EUVD, the affected range is hMailServer 6.2.28 up to (but not including) 6.3.6; no CPE strings were supplied with this record, so product identification rests on the vendor release and work-item references.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Remote REST API reachability gives AV:N/AC:L, a valid mailbox login is required so PR:L, and the sole effect is forced session logout yielding A:L with no C/I impact.
Primary rating from Vendor (gitlab).
CVSS VectorVendor: gitlab
Lifecycle Timeline
1DescriptionCVE.org
Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote authenticated user to end other users' sessions. The table of browser sessions, shared by every account, the server administrator and support sessions, dropped its least recently used session whenever it was full, whoever it belonged to, and placed no limit on how many sessions one account could hold. A user who repeatedly signs in with their own mailbox password can therefore keep the table full and sign out every webmail and administration session that is idle for more than a short time, for as long as they continue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB