{"id":"CVE-2026-107576","published":"2026-10-08T12:17:15.487","lastModified":"2026-10-08T21:02:43.860","description":"Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the mail services unavailable by sending a message. Building the canonical header and choosing the header fields named in a signature's h= tag took time growing with the square of the message's header: the 'simple' canonicalisation prepended each continuation line of a folded field to the lines already gathered, and both canonicalisations searched the gathered fields from the bottom for each h= name and erased the match from the middle of the list. A message whose header holds very many fields, or a field folded over very many lines, with a DKIM-Signature the attacker signs for a domain they control, keeps a worker thread busy for tens of seconds per signature; up to ten signatures are evaluated per message by each of the DKIM and DMARC tests, on the threads that serve delivery and SMTP.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-407"],"vendors":[],"products":[],"references":[{"url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6","tags":[]},{"url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/73","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Progressive Robot hMailServer has an inefficient algorithm in its DKIM and ARC signature verification that causes excessive CPU usage when processing messages with many header fields or folded lines. This allows a remote attacker to perform a denial-of-service attack by sending specially crafted messages that keep worker threads busy for tens of seconds per signature.","exploitability":"Exploitation is relatively straightforward as it requires only sending a message with a DKIM signature for a controlled domain, but the attack is most effective when the message contains many header fields or folded lines to maximize the computational overhead.","blast_radius":"The impact could be significant across all email services using hMailServer 6.0.0 through 6.3.5, as the DoS condition affects worker threads handling delivery and SMTP connections, potentially making the mail service unavailable to legitimate users.","remediation":"Upgrade to hMailServer version 6.4.0 or later to address the inefficient algorithmic complexity in DKIM and ARC signature verification.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["email","dos","dkim"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:27:54.768Z"}}