{"id":"CVE-2026-107574","published":"2026-10-08T12:17:15.177","lastModified":"2026-10-08T21:02:43.860","description":"Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unavailable. Reading a JSON object kept the first of each duplicated member name by searching the members already read, so an object of N distinct member names cost O(N^2): 1 MB took 8.9 seconds and 4 MB took 300 seconds against the affected code. A remote attacker reaches the reader without an account by mailing a crafted TLS-RPT report (up to 16 MB after decompression) to a hosted domain's published report mailbox, which is read on a delivery thread; a few such reports hold every delivery thread (ten by default), so the server delivers no mail, local or outbound, for over an hour per report. A signed-in account reaches the same 16 MB body through the webmail's own REST routes, holding the REST API's own worker threads. Where no report mailbox is configured, the unauthenticated REST sign-in routes that read a JSON body are capped at 64 KB and are not affected.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-407"],"vendors":[],"products":[],"references":[{"url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6","tags":[]},{"url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/76","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Progressive Robot hMailServer has an inefficient JSON reader that causes quadratic time complexity when processing JSON objects with duplicate member names, allowing remote attackers to crash the mail service by sending specially crafted TLS-RPT reports or using the webmail REST API.","exploitability":"Exploitation is relatively easy as attackers only need to send a crafted TLS-RPT report to a hosted domain's report mailbox or use the webmail REST API without authentication, with no additional preconditions required.","blast_radius":"The impact is significant as the server becomes completely unresponsive for over an hour per malicious report, halting all mail delivery including local and outbound messages, affecting all users on the affected server.","remediation":"Upgrade to version 2.590 or later to fix the inefficient JSON reader algorithm that causes O(N^2) processing time for JSON objects with duplicate member names.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["mail","json","dos"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:03:43.657Z"}}