CVE-2026-107582 Progressive Robot Ltd CVE debrief

Who should care

Defenders responsible for hMailServer instances, particularly those exposed to the internet or used in critical infrastructure, should assess exposure and apply patches or mitigations.

Why it matters

CVE-2026-107582 allows remote attackers to cause denial-of-service conditions in hMailServer, impacting availability of webmail, administration console, and REST API. Defenders should verify exposure, apply patches, and monitor for unusual activity.

• Potential for service disruption due to denial-of-service conditions.
• Need for verification of exposure and application of patches or mitigations.
• Possible impact on webmail, administration console, and REST API availability.
• Requirement for monitoring and potential compensating controls.

Technical summary

The vulnerability is caused by inefficient algorithmic complexity in the REST API and IMAP PREVIEW response of hMailServer, allowing remote unauthenticated attackers to cause denial-of-service conditions by sending specially crafted messages. This impacts the availability of webmail, administration console, and REST API. The inefficient complexity is in the server's shared string class, whose replace and remove both ran in quadratic time. A received HTML-only message holding a very large number of entity references therefore keeps one of the listener's four worker threads busy for minutes or longer each time the recipient's webmail lists the folder, without the message being opened.

Defensive priority

Defenders should prioritize verifying exposure and applying patches due to potential for service disruption.

Recommended defensive actions

• Verify if hMailServer instances are exposed to the internet and if versions 6.2.22 through 6.3.5 are in use.
• Apply patches or updates to affected versions as recommended by the vendor.
• Monitor webmail, administration console, and REST API for unusual activity or performance issues.
• Consider implementing compensating controls, such as rate limiting or IP blocking, to mitigate potential attacks.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and affected versions. However, limited information is available on actual exploitation or victim impact. The vulnerability affects hMailServer versions 6.2.22 through 6.3.5. Defenders should verify if hMailServer instances are exposed to the internet and if versions 6.2.22 through 6.3.5 are in use.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.