EUVD-2026-94866
GHSA-2vm3-8w38-9p34
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attacker emails the server with no credentials (AV:N/PR:N/AC:L) but the recipient must open the message (UI:R); only availability is affected (C:N/I:N/A:H), same scope (S:U).
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
3DescriptionCVE.org
Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders a received message's HTML replaced each reference to an embedded image in place, with work that grew with the square of the number of references, and wrote the image out for every reference while counting it against its size limit only once. A message whose HTML refers to one small embedded image a very large number of times, opened in the webmail by its recipient, therefore keeps one of the listener's four worker threads busy for minutes and makes it build a document of gigabytes, so that a few such messages leave the HTTP listener unable to answer anybody.
AnalysisAI
Denial of service in hMailServer 6.3.2 through 6.3.5 lets an unauthenticated remote attacker exhaust the webmail/REST HTTP listener by sending a message that references one small embedded image an extreme number of times, if the recipient opens it in webmail. The rendering path has quadratic work and can occupy one of four worker threads for minutes while building a multi-gigabyte document, so a few messages can make webmail, the administration console, and the REST API unavailable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the targeted recipient open the attacker's message in hMailServer's webmail REST API message-view route, which renders embedded-image HTML with complexity growing as the square of the number of image references - so the attacker needs no account (PR:N) but does depend on victim interaction (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority availability issue, not a critical one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to hMailServer 6.3.6 or later (vendor-released patch: 6.3.6) as referenced in https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6 and https://gitlab.com/hmailserver/hmailserver/-/work_items/65; per the vendor and EUVD, versions before 6.3.6 are affected. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmailserver
View allArbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticate
Cross-site scripting in Progressive Robot hMailServer 6.3.2 through 6.3.5 can let a remote, unauthenticated attacker exe
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any loc
Heap-based buffer overflow in hMailServer 6.0.0 through 6.3.3 on Windows lets a local interactive user - with no hMailSe
Local privilege escalation in hMailServer 6.0.0 through 6.3.5 on Windows allows an authenticated local user-one with an
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 on Linux allows an attacker who already has
Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail del
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first inst
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5
DNS rebinding against Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote, unauthenticated attacker to bru
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allShare
External POC / Exploit Code
Leaving vuln.today