EUVD-2026-94857
GHSA-qcpx-92mh-q44f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Remotely triggered by sending mail with no auth or interaction (AV:N/AC:L/PR:N/UI:N); only partial, bounded worker-thread consumption and no data impact (A:L, C:N/I:N).
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
3DescriptionCVE.org
Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels from the left; the server did this by removing one label at a time and copying the rest of the name each time, so the work grew with the square of the expansion. An attacker who publishes an SPF record for a domain they control, with a mechanism whose domain-spec expands through macros to a name far longer than 253 characters, makes the SPF check of a message from that domain take several seconds. The expansion is bounded by SPF's own per-term and per-macro limits, so the loss of availability is partial.
AnalysisAI
Quadratic algorithmic complexity in the SPF macro-expansion path of hMailServer 6.3.4 and 6.3.5 allows a remote, unauthenticated attacker to consume worker-thread time by sending mail from a domain whose SPF record they control and which expands through macros to a domain name far longer than 253 characters, making each SPF check take several seconds. The attack requires SPF validation to be enabled on an inbound path and is bounded by SPF's own per-term and per-macro limits, so the resulting availability loss is partial rather than a complete outage. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that hMailServer perform an SPF check on an inbound message, i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-to-moderate priority issue, and the raw CVSS of 5.3 (MEDIUM) accurately reflects it rather than overstating it. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to hMailServer 6.3.6, which is the first version containing the corrected RFC 7208 section 7.1 label-dropping logic (release notes and binaries at https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6, technical detail at https://gitlab.com/hmailserver/hmailserver/-/work_items/74). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmailserver
View allArbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticate
Cross-site scripting in Progressive Robot hMailServer 6.3.2 through 6.3.5 can let a remote, unauthenticated attacker exe
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any loc
Heap-based buffer overflow in hMailServer 6.0.0 through 6.3.3 on Windows lets a local interactive user - with no hMailSe
Local privilege escalation in hMailServer 6.0.0 through 6.3.5 on Windows allows an authenticated local user-one with an
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 on Linux allows an attacker who already has
Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail del
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first inst
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5
DNS rebinding against Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote, unauthenticated attacker to bru
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allShare
External POC / Exploit Code
Leaving vuln.today