Medium · CVSS 6.5CVE-2026-107582

Inefficient Algorithmic Complexity in hMailServerCVE-2026-107582

Answer in brief

CVE-2026-107582 records a Medium severity (CVSS 6.5) vulnerability in Inefficient Algorithmic Complexity in hMailServer. The current sources do not mark it as known exploited. The current feed maps Progressive Robot Ltd/hMailServer (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Oct 8, 2026Updated Oct 8, 2026Source checked Oct 8, 2026First seen by HOL Oct 8, 2026Material review Oct 8, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 6.5
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Available

Why this deserves its current priority

CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Progressive Robot Ltd/hMailServer (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Progressive Robot Ltd/hMailServergeneric	>=6.2.22-pre1 <6.3.6	6.3.6

Recommended response

Check inventory. Check lockfiles and deployed manifests for Progressive Robot Ltd/hMailServer.
Review the reported fix. Source-reported solution: Upgrade to hMailServer 6.3.6, whose string replacement and removal write their result in one pass. Until then: lower the maximum message size, which bounds the cost (it grows with the square of the HTML's size); remove such a message over IMAP or POP3; or keep the REST listener off (RestApiPort 0, the default).

Evidence timeline and material changes

Published upstream
Oct 8, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 8, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Oct 8, 2026

Sources and claim methodology

Upstream source description

Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. To show a snippet of each message in a folder's message list, the server decoded the character entity references of a message that has an HTML part and no text part with a string replacement whose work grew with the square of their number. A received HTML-only message holding a very large number of entity references therefore keeps one of the listener's four worker threads busy for minutes or longer each time the recipient's webmail lists the folder, without the message being opened, so that a few such listings leave the HTTP listener unable to answer anybody. The IMAP PREVIEW response read such text the same way, holding an IMAP thread for each client that asks for the preview of such a message. The flaw is in the server's shared string class, whose replace and remove both ran in quadratic time.

Quoted source text, attributed separately from HOL analysis.