IT SBIT Services
Schneeberger
DEEN
CVE tracker

hMailServer: Inefficient algorithmic complexity in JSON reader

CVE-2026-126623High 7.5

← All vulnerabilities

Summary

hMailServer 6.3.6 and 6.3.7 contain a JSON reader whose duplicate-name check has quadratic cost when member names are chosen to share one hash bucket. A remote attacker can send a crafted JSON object as a TLS-RPT report to a hosted domain's report mailbox, or use other reachable routes such as the reply to a password-protected message or the send API. Each request then occupies a mail delivery thread or one of the REST API's worker threads for seconds to minutes, which can stop all mail delivery and make the REST API and webmail unavailable. Nothing is read or changed; the impact is availability only.

Affected

  • hMailServer 6.3.6 (Progressive Robot Ltd fork)
  • hMailServer 6.3.7 (Progressive Robot Ltd fork)
  • Not affected: the original hMailServer by Martin Knafve, according to the vendor

Fixed in

  • hMailServer 6.3.8

Workaround

  • Until the update is installed, clear each domain's report mailbox or move it off the domains the server hosts.
  • Switch OpenPGP in the webmail off (portal_enabled under /api/v1/settings/openpgp), and off for any domain or account where openpgp_portal_enabled is set.
  • Clearing the public base URL is not sufficient, because links already created remain usable.
  • Keep the REST API off unless it is needed; it is off by default.

Exploitation

  • The vendor measured the effect with crafted objects on the released versions.
  • No evidence of active exploitation is known at the time of writing.

Our recommendation

  • Upgrade all servers running 6.3.6 or 6.3.7 to hMailServer 6.3.8.
  • Apply the workarounds above if the update cannot be installed immediately.
  • Check whether the REST API, webmail or TLS-RPT report mailboxes are exposed to the internet.
  • Monitor delivery queues and service availability for signs of stalled mail delivery.
  • After upgrading, test mail delivery, because the vendor reports that some messages to certain domains may stay queued.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:25.

Original description (NVD)

Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer 6.3.6 and 6.3.7 allows a remote attacker to hold the server's mail delivery threads or its REST API's worker threads, making mail delivery, the REST API and the webmail unavailable. 6.3.6 fixed CVE-2026-107574, in which reading a JSON object searched the member names already read for each new name, by keeping the names in a hash set; the set uses the standard library's hash, which takes no secret, so member names chosen to fall in one bucket of it still cost time growing with the square of their number. Against the released reader, one such object of 16 MB took about 5 seconds to read in the Linux build, and one of under 6 MB about 23 seconds in the Windows build, where objects of the same sizes with other names took under a tenth of a second. A remote unauthenticated attacker reaches the reader by mailing such an object as a TLS-RPT report, up to 16 MB once decompressed, to a hosted domain's report mailbox, where an administrator has set one; it is read on a mail delivery thread (ten by default), and those threads deliver all mail, local and outbound, so a stream of such reports stops all delivery for as long as it continues. It is also reached without an account through the reply to a password-protected message, with the message's link alone, where the REST API is on (it is off by default) and a public base URL for such links is set; and by any account through the webmail's routes granted 16 MB, and by an application's API key through the send API. Each such request holds one of the REST API's four worker threads, in the process that also serves SMTP, IMAP and POP3.

NVD references (3)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed