CVE-2026-107575 Progressive Robot Ltd CVE debrief

Who should care

System administrators and security teams responsible for hMailServer installations should assess exposure and update to version 6.3.6 or later. They should also monitor SPF record publications for potential abuse and implement rate limiting on SPF checks. Additionally, they should review and update their systems to ensure they are not vulnerable to this issue.

Why it matters

CVE-2026-107575 allows remote attackers to cause a denial of service in hMailServer by publishing a crafted SPF record. System administrators and security teams should assess exposure, update to version 6.3.6 or later, and monitor SPF record publications.

• Denial of service through worker-thread time consumption
• Potential for partial loss of availability
• Need for verification of affected versions and remediation
• Importance of monitoring SPF record publications

Technical summary

The vulnerability is caused by inefficient algorithmic complexity in the SPF macro expansion of hMailServer 6.3.4 and 6.3.5. An attacker can publish a crafted SPF record to consume worker-thread time, leading to a denial of service. The expansion is bounded by SPF's own per-term and per-macro limits, so the loss of availability is partial. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. The affected product is hMailServer, and the vulnerability affects versions 6.3.4 and 6.3.5. The recommended solution is to update to version 6.3.6 or later.

Defensive priority

Medium

Recommended defensive actions

• Review and update hMailServer to version 6.3.6 or later
• Monitor SPF record publications for potential abuse
• Implement rate limiting on SPF checks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on potential exploits or victims. The vulnerability affects hMailServer versions 6.3.4 and 6.3.5. There is no information on publicly available exploits or reports of attacks. The CVE record was published on 2026-10-08T11:46:46.082Z and has not been modified since then. The source item provides additional details on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.