HMailServer (6.3.2 - 6.3.7) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/hmailserver-6.3.2---6.3.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 14:04:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgProgressive Robot hMailServer: Resource exhaustion via JSON reader (CVE-2026-126613)https://feed.craftedsignal.io/briefs/2026-11-hmailserver-resource-exhaustion-cve-2026-126613/Wed, 11 Nov 2026 14:04:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-hmailserver-resource-exhaustion-cve-2026-126613/Progressive Robot hMailServer versions 6.3.2 through 6.3.7 contain a vulnerability in the JSON reader that allows for resource exhaustion via a specially crafted JSON document.<p>Allocation of resources without limits in the JSON reader of Progressive Robot hMailServer 6.3.2 through 6.3.7 allows a remote attacker to exhaust the server's memory and hold its threads, making mail delivery, the REST API, and the webmail unavailable. The reader creates a tree of values larger than the input, leading to potential memory and thread exhaustion when processing JSON documents of up to 16 MB.</p> lowadvisory