Progressive Robot hMailServer: Resource exhaustion via JSON reader (CVE-2026-126613)
Progressive Robot hMailServer versions 6.3.2 through 6.3.7 contain a vulnerability in the JSON reader that allows for resource exhaustion via a specially crafted JSON document.
CVE search metadata
CVE search record: CVE-2026-126613. Severity: high. CVSS: 7.5. KEV: no. Product: hMailServer (6.3.2 - 6.3.7). Brief: Progressive Robot hMailServer: Resource exhaustion via JSON reader (CVE-2026-126613). Brief link: https://feed.craftedsignal.io/briefs/2026-11-hmailserver-resource-exhaustion-cve-2026-126613/
Triage facts
Revision 1- Applicability
- hMailServer (6.3.2 - 6.3.7)
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 14:04 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Allocation of resources without limits in the JSON reader of Progressive Robot hMailServer 6.3.2 through 6.3.7 allows a remote attacker to exhaust the server's memory and hold its threads, making mail delivery, the REST API, and the webmail unavailable. The reader creates a tree of values larger than the input, leading to potential memory and thread exhaustion when processing JSON documents of up to 16 MB.