EUVD-2026-94854
GHSA-2c7f-jhwj-7q7h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remotely reachable by mailing a report with no account on TLS-RPT-enabled servers (AV:N/PR:N/UI:N), trivial to craft (AC:L), and availability-only with no confidentiality or integrity impact (C:N/I:N/A:H).
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
4DescriptionCVE.org
Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unavailable. Reading a JSON object kept the first of each duplicated member name by searching the members already read, so an object of N distinct member names cost O(N^2): 1 MB took 8.9 seconds and 4 MB took 300 seconds against the affected code. A remote attacker reaches the reader without an account by mailing a crafted TLS-RPT report (up to 16 MB after decompression) to a hosted domain's published report mailbox, which is read on a delivery thread; a few such reports hold every delivery thread (ten by default), so the server delivers no mail, local or outbound, for over an hour per report. A signed-in account reaches the same 16 MB body through the webmail's own REST routes, holding the REST API's own worker threads. Where no report mailbox is configured, the unauthenticated REST sign-in routes that read a JSON body are capped at 64 KB and are not affected.
AnalysisAI
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first instance of each duplicated member name by rescanning the members already read, so an object with N distinct names costs O(N²) - roughly 8.9 seconds for a 1 MB payload and 300 seconds for 4 MB against the affected code. An unauthenticated remote attacker can reach this reader by mailing a crafted TLS-RPT report (compressed, expanding to as much as 16 MB after decompression) to a hosted domain's published report mailbox, where it is parsed on a delivery thread; with only ten delivery threads by default, a few such reports stall all mail delivery, both local and outbound, for over an hour per report. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The unauthenticated remote path requires the target to host a domain with a published/configured TLS-RPT report mailbox; the attacker then mails a crafted TLS-RPT report (compressed, expanding to up to 16 MB) that is parsed on a delivery thread. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to a genuine but bounded availability-only threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Primary fix: upgrade to the referenced upstream release v6.3.6, which the project publishes as the corrected hMailServer build, and verify the version boundary in the release notes at https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6 and the tracking item https://gitlab.com/hmailserver/hmailserver/-/work_items/76. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm hMailServer version and whether TLS-RPT report processing is enabled; if not required, disable TLS-RPT processing or redirect the published report mailbox off hMailServer, enforce compressed and decompressed message-size limits at the gateway, and restrict webmail REST API access to trusted networks/users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmailserver
View allArbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticate
Cross-site scripting in Progressive Robot hMailServer 6.3.2 through 6.3.5 can let a remote, unauthenticated attacker exe
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any loc
Heap-based buffer overflow in hMailServer 6.0.0 through 6.3.3 on Windows lets a local interactive user - with no hMailSe
Local privilege escalation in hMailServer 6.0.0 through 6.3.5 on Windows allows an authenticated local user-one with an
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 on Linux allows an attacker who already has
Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail del
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5
DNS rebinding against Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote, unauthenticated attacker to bru
Outbound SMTP delivery in Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when DANE (RFC 7672) validation c
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allShare
External POC / Exploit Code
Leaving vuln.today