{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aprogressive_robothmailserver6.3.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:progressive_robot:hmailserver:6.3.6:*:*:*:*:*:*:*","cpe:2.3:a:progressive_robot:hmailserver:6.3.7:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-126623"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["hMailServer (6.3.6, 6.3.7)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Progressive Robot"],"content_html":"\u003cp\u003eProgressive Robot hMailServer versions 6.3.6 and 6.3.7 contain an inefficient algorithmic complexity issue in the JSON reader. The vulnerability stems from the use of a standard library hash function without secret salt for hash set operations when processing JSON member names. A remote unauthenticated attacker can craft a JSON object where member names collide within the same hash bucket, forcing quadratic time complexity during parsing. Exploitation results in thread exhaustion of mail delivery threads, REST API worker threads, and webmail services.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to a denial of service for mail delivery, the REST API, and webmail functionality. The attack can impact server performance by holding mail delivery threads (default 10) or REST API worker threads (default 4), potentially halting all inbound and outbound mail processing as long as the attack stream continues.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eIdentify and inventory all deployments of Progressive Robot hMailServer 6.3.6 and 6.3.7. As the source describes a fundamental algorithmic flaw in the JSON processing logic, patch management is the primary mitigation; contact the vendor for the appropriate security update addressing this complexity issue. Implement rate limiting on incoming mail and REST API requests to mitigate the impact of high-resource-usage payloads until patching can be completed.\u003c/p\u003e\n","date_modified":"2026-11-11T14:04:31Z","date_published":"2026-11-11T14:04:31Z","id":"https://feed.craftedsignal.io/briefs/2026-11-hmailserver-json-dos-cve-2026-126623/","summary":"A vulnerability in the JSON reader of Progressive Robot hMailServer versions 6.3.6 and 6.3.7 allows remote unauthenticated attackers to cause a denial of service by sending specifically crafted JSON objects that trigger high CPU utilization.","title":"Progressive Robot hMailServer: Denial of Service via JSON reader algorithmic complexity (CVE-2026-126623)","url":"https://feed.craftedsignal.io/briefs/2026-11-hmailserver-json-dos-cve-2026-126623/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:progressive_robot:hmailserver:6.3.6:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}