{"id":"CVE-2026-107583","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-107583","generatedAt":"2026-10-28T02:58:12.414Z","title":"Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable…","description":"Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders a received message's HTML replaced each reference to an embedded image in place, with work that grew with the square of the number of references, and wrote the image out for every reference while counting it against its size limit only once. A message whose HTML refers to one small embedded image a very large number of times, opened in the webmail by its recipient, therefore keeps one of the listener's four worker threads busy for minutes and makes it build a document of gigabytes, so that a few such messages leave the HTTP listener unable to answer anybody.","published":"2026-10-08T12:17:17.000Z","lastModified":"2026-10-08T21:02:44.000Z","status":"Deferred","sourceIdentifier":"cve@gitlab.com","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},"cwe":["CWE-407"],"affected":[],"epss":{"score":0.00257,"percentile":0.17167,"date":"2026-10-26","history":[{"date":"2026-10-09","score":0.00257,"percentile":0.15927}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-08T12:17:17.000Z","detail":{"score":"6.5","severity":"MEDIUM","publishedAt":"2026-10-08T12:17:16.633Z"},"summary":"New CVE, medium severity (CVSS 6.5)."}],"references":[{"url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6","source":"cve@gitlab.com"},{"url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/65","source":"cve@gitlab.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-107583","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}