HMailServer (6.3.6, 6.3.7) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/hmailserver-6.3.6-6.3.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 14:04:31 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgProgressive Robot hMailServer: Denial of Service via JSON reader algorithmic complexity (CVE-2026-126623)https://feed.craftedsignal.io/briefs/2026-11-hmailserver-json-dos-cve-2026-126623/Wed, 11 Nov 2026 14:04:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-hmailserver-json-dos-cve-2026-126623/A vulnerability in the JSON reader of Progressive Robot hMailServer versions 6.3.6 and 6.3.7 allows remote unauthenticated attackers to cause a denial of service by sending specifically crafted JSON objects that trigger high CPU utilization.Progressive Robot hMailServer versions 6.3.6 and 6.3.7 contain an inefficient algorithmic complexity issue in the JSON reader. The vulnerability stems from the use of a standard library hash function without secret salt for hash set operations when processing JSON member names. A remote unauthenticated attacker can craft a JSON object where member names collide within the same hash bucket, forcing quadratic time complexity during parsing. Exploitation results in thread exhaustion of mail delivery threads, REST API worker threads, and webmail services.

Impact

Successful exploitation leads to a denial of service for mail delivery, the REST API, and webmail functionality. The attack can impact server performance by holding mail delivery threads (default 10) or REST API worker threads (default 4), potentially halting all inbound and outbound mail processing as long as the attack stream continues.

Recommendation

Identify and inventory all deployments of Progressive Robot hMailServer 6.3.6 and 6.3.7. As the source describes a fundamental algorithmic flaw in the JSON processing logic, patch management is the primary mitigation; contact the vendor for the appropriate security update addressing this complexity issue. Implement rate limiting on incoming mail and REST API requests to mitigate the impact of high-resource-usage payloads until patching can be completed.

]]>lowadvisory