EUVD-2026-94858
GHSA-q3hj-9493-685w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
A message sent over SMTP reaches the parser unauthenticated with low complexity, causing availability loss only (infinite loop / CPU exhaustion), with no confidentiality or integrity impact.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
4DescriptionCVE.org
Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote unauthenticated attacker to make the mail services unavailable by sending a message. Removing a MIME header parameter whose value is empty and directly followed by a semicolon (for example a Content-Disposition with 'filename=a.bat; filename=;') entered a loop that never terminates, holding a worker thread at full load until the server is restarted; this is reached when the attachment blocker renames a blocked attachment or a filename is set over the REST API. Separately, decoding a header field that holds many RFC 2047 encoded words of an encoding other than base64 or quoted-printable, removing a parameter with many RFC 2231 continuations, and deleting many header fields of one name each took time growing with the square of the message, on the small thread pools that serve IMAP, SMTP and POP3 connections, delivery and the REST API.
Articles & Coverage 2
AnalysisAI
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make SMTP, IMAP, POP3, delivery, and REST API services unavailable by sending a crafted message. A non-terminating MIME header parsing loop pins a worker thread at full CPU until restart, but that path is only reached when the attachment blocker is configured to rename a blocked attachment or when a filename is set via the REST API; a broader quadratic-complexity path in RFC 2047/RFC 2231 header handling and repeated header deletion is reachable on default mail intake. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The quadratic-complexity DoS requires no special conditions beyond the ability to send a message to the server over SMTP (or trigger processing via IMAP/POP3, delivery, or the REST API) using a header with many RFC 2047 encoded words in an encoding other than base64/quoted-printable, many RFC 2231 continuations, or many repeated header fields of one name - exploitable against default-reachable mail intake on hMailServer 6.0.0 through 6.3.5. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to a genuine but bounded availability risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to hMailServer 6.3.6, the vendor-released patch that removes both the non-terminating-loop and quadratic-complexity paths. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all hMailServer deployments to identify instances running versions 6.0.0 through 6.3.5 and confirm monitoring is in place to detect worker-thread CPU saturation or unexpected service restarts on those hosts, since a restart is currently the only recovery path. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today