Description
Allocation of resources without limits in the JSON reader of Progressive Robot hMailServer 6.3.2 through 6.3.7 allows a remote attacker to exhaust the server's memory and hold its threads, making mail delivery, the REST API and the webmail unavailable. The reader built a tree of values far larger than the text it read, copying each value into every level above it, and set no bound on the number of values, so a single JSON document of many small values, within the 16 MB the server reads, raised the service's memory by about 2 GB and held one thread for seconds to minutes. From 6.3.4 a remote unauthenticated attacker reaches the reader by mailing such a document as a TLS-RPT report, up to 16 MB once decompressed, to a hosted domain's report mailbox, where an administrator has set one; it is read on a mail delivery thread (ten by default), and those threads deliver all mail, local and outbound. From 6.3.4 it is also reached without an account through the reply to a password-protected message, with the message's link alone, where the REST API is on (it is off by default) and a public base URL for such links is set; and by any account, from 6.3.2 through the webmail's send and draft routes and from 6.3.4 through its other routes granted 16 MB and the send API; the webmail's send, draft and settings routes parsed the body again for each member read. The REST API serves every request on four worker threads, in the process that also serves SMTP, IMAP and POP3, so a few such documents at once make it unavailable and can exhaust the machine's memory and end the whole service. This is a separate defect from CVE-2026-107574, the reader's handling of duplicate member names, fixed in 6.3.6.
Published: 2026-11-11
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Upgrade to hMailServer 6.3.8, whose JSON reader moves each value into its place rather than copying it, and in which a REST request body is parsed within the bounds before any handler reads it, and the shared member readers read that one parse; a REST request body is held to 100,000 values, 10,000 members in an object and 32 levels, and a mailed TLS-RPT report to 200,000 values, 10,000 members in an object and 32 levels, each refused at the first value past a bound; the reply to a password-protected message is held to 2 MB. Until then, on 6.3.4 to 6.3.7, clear each domain's report mailbox, or move it off the domains the server hosts, so that no report is read by the server; and switch OpenPGP in the webmail off (portal_enabled under /api/v1/settings/openpgp), and off for any domain or account that holds openpgp_portal_enabled on, which refuses the reply to a password-protected message before its body is parsed; clearing the public base URL is not enough, since links already made stay usable. For the routes that take an account or an API key, only limiting who can reach the REST API avoids it (RestApiPort 0, the default, turns it off), or a reverse proxy in front of it that holds request bodies well below 16 MB. Restarting the service ends a busy thread.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Nov 2026 08:45:00 +0000

Type Values Removed Values Added
Description Allocation of resources without limits in the JSON reader of Progressive Robot hMailServer 6.3.2 through 6.3.7 allows a remote attacker to exhaust the server's memory and hold its threads, making mail delivery, the REST API and the webmail unavailable. The reader built a tree of values far larger than the text it read, copying each value into every level above it, and set no bound on the number of values, so a single JSON document of many small values, within the 16 MB the server reads, raised the service's memory by about 2 GB and held one thread for seconds to minutes. From 6.3.4 a remote unauthenticated attacker reaches the reader by mailing such a document as a TLS-RPT report, up to 16 MB once decompressed, to a hosted domain's report mailbox, where an administrator has set one; it is read on a mail delivery thread (ten by default), and those threads deliver all mail, local and outbound. From 6.3.4 it is also reached without an account through the reply to a password-protected message, with the message's link alone, where the REST API is on (it is off by default) and a public base URL for such links is set; and by any account, from 6.3.2 through the webmail's send and draft routes and from 6.3.4 through its other routes granted 16 MB and the send API; the webmail's send, draft and settings routes parsed the body again for each member read. The REST API serves every request on four worker threads, in the process that also serves SMTP, IMAP and POP3, so a few such documents at once make it unavailable and can exhaust the machine's memory and end the whole service. This is a separate defect from CVE-2026-107574, the reader's handling of duplicate member names, fixed in 6.3.6.
Title Allocation of Resources Without Limits or Throttling in hMailServer
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-11-11T08:31:12.127Z

Reserved: 2026-11-11T08:04:44.444Z

Link: CVE-2026-126613

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-11T09:17:13.267

Modified: 2026-11-11T09:17:13.267

Link: CVE-2026-126613

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses