CVE-2026-107574 Progressive Robot Ltd CVE debrief

Who should care

Defenders responsible for mail server administration and security should assess exposure and prioritize verification. This includes reviewing the mail server's configuration, version of hMailServer in use, and ensuring that the server is not vulnerable to exploitation.

Why it matters

CVE-2026-107574 allows remote attackers to cause mail service unavailability in Progressive Robot hMailServer through inefficient algorithmic complexity in the JSON reader. Defenders should verify exposure, especially for unauthenticated mail services and REST API worker threads, and prioritize upgrading to version 6.3.6 or later.

• Potential for mail service unavailability impacting business operations.
• Risk of exploitation through unauthenticated mail services and REST API worker threads.
• Need for verification of mail server configuration and version.
• Potential for denial-of-service (DoS) attacks through crafted TLS-RPT reports or REST routes.

Technical summary

The JSON reader in Progressive Robot hMailServer has an inefficient algorithmic complexity, allowing a remote unauthenticated attacker to cause the mail services to become unavailable. The attack can be performed by sending a crafted TLS-RPT report to a hosted domain's published report mailbox or through the webmail's REST routes. The vulnerability impacts mail delivery for over an hour per report and requires no authentication.

Defensive priority

Defenders should prioritize verifying exposure, especially for unauthenticated mail services and REST API worker threads. They should also assess the mail server's configuration, particularly the presence of a report mailbox, and review the version of hMailServer in use.

Recommended defensive actions

• Verify the version of hMailServer in use and ensure it is 6.3.6 or later.
• Assess the mail server's configuration, particularly the presence and accessibility of a report mailbox.
• Review and limit access to the webmail's REST routes.
• Monitor mail delivery and server performance for signs of potential exploitation.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its impact on mail services and potential attack vectors. However, the corpus does not establish specific versions affected beyond 6.2.28 and less than 6.3.6, or provide explicit details on remediation beyond upgrading to version 6.3.6.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.