---
id: CVE-2026-107583
title: >-
  Inefficient algorithmic complexity in the webmail's message view of the REST
  API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote
  unauthenticated attacker to make the webmail, the administration console and
  the REST A…
summary: >-
  Inefficient algorithmic complexity in the webmail's message view of the REST
  API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote
  unauthenticated attacker to make the webmail, the administration console and
  the REST A…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cwe:
  - CWE-407
vendor: Progressive Robot Ltd
product: hMailServer
affected:
  - hMailServer >= 6.3.2 < 6.3.6
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T15:17:44.647'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107583'
references:
  - url: 'https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6'
    label: cve@gitlab.com
  - url: 'https://gitlab.com/hmailserver/hmailserver/-/work_items/65'
    label: cve@gitlab.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T14:13:59.332199Z'
ingestedAt: '2026-10-08T12:39:48.758Z'
---

## Overview

Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders a received message's HTML replaced each reference to an embedded image in place, with work that grew with the square of the number of references, and wrote the image out for every reference while counting it against its size limit only once. A message whose HTML refers to one small embedded image a very large number of times, opened in the webmail by its recipient, therefore keeps one of the listener's four worker threads busy for minutes and makes it build a document of gigabytes, so that a few such messages leave the HTTP listener unable to answer anybody.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.