EUVD-2026-94867

Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE RFC 7672 to outbound SMTP delivery. The server's validating DNSSEC resolver treated a TLSA or MX lookup that did not complete no answer, SERVFAIL, a malformed reply, an answer without the requested records and without...

CVE-2026-107584

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 are vulnerable to a fail-open condition when applying DANE (RFC 7672) to outbound SMTP delivery. The root cause is that the server's validating DNSSEC resolver treats incomplete lookups (no answer, SERVFAIL, or malformed replies), records...

CVE-2026-107583

Progressive Robot hMailServer versions 6.3.2 through 6.3.5 are vulnerable to an inefficient algorithmic complexity flaw in the webmail's message view of the REST API . A remote unauthenticated attacker can send a message containing an HTML reference to a single small embedded image a very large n...

EUVD-2026-94866

Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders ...

CVE-2026-107587

Progressive Robot hMailServer versions 6.3.2 through 6.3.5 are vulnerable to improper certificate validation within the webmail component. A remote unauthenticated attacker can cause the system to retain a signer's certificate—regardless of whether the certificate chain is trusted—under the first...

EUVD-2026-94865

Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. When its recipient opened a signed...

CVE-2026-107582

Progressive Robot hMailServer versions 6.3.3 through 6.3.5 (REST API) and 6.2.22 through 6.3.5 (IMAP PREVIEW) are vulnerable to an inefficient algorithmic complexity flaw. The issue resides in the server's shared string class , where the replace and remove operations run in quadratic time . A rem...

EUVD-2026-94864

Inefficient algorithmic complexity in the REST API 6.3.3 through 6.3.5 and the IMAP PREVIEW response 6.2.22 through 6.3.5 of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. To...

CVE-2026-107580

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 are vulnerable to a Denial of Service (DoS) attack due to inefficient algorithmic complexity during the decoding of message header fields. A remote unauthenticated attacker can send a message containing an RFC 2047 encoded word with a hig...

EUVD-2026-94861

Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery by sending messages, when bounce processing or complaint processing is enabled or a mailing list is managed by...

CVE-2026-107579 Inefficient Algorithmic Complexity in hMailServer

Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery by sending messages, when bounce processing or complaint processing is enabled or a mailing list is managed by...

EUVD-2026-94860

Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege service account to escalate privilege. On Windows,...

EUVD-2026-94858

Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote unauthenticated attacker to make the mail services unavailable by sending a message. Removing a MIME header parameter whose...

CVE-2026-107572

Progressive Robot hMailServer versions 6.2.24 through 6.3.5 are vulnerable to a Denial of Service (DoS) condition due to inefficient complexity in Sieve filter evaluation. The vulnerability arises from a backtracking descent during :matches pattern matching, where execution time grows exponential...

EUVD-2026-94856

Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the match...

CVE-2026-107573 Incorrect Default Permissions in hMailServer

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the...

CVE-2026-107573

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 on Windows suffer from incorrect default permissions in the installer. The installer creates data, log, temp, database, and event folders, along with the hMailServer.INI configuration file, using permissions inherited from the installatio...

EUVD-2026-94854

Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unavailable. Reading a JSON object kept the first of each duplicated member name by searching the members already read, so an object of N...

CVE-2026-107574

Progressive Robot hMailServer is vulnerable to a Denial of Service (DoS) attack due to inefficient algorithmic complexity (O(N^2)) in its JSON reader. The component fails to efficiently handle duplicated member names, causing significant processing delays: a 4 MB object can take 300 seconds to pr...

CVE-2026-104658

The Linux live-update apply helper hmailserver-update of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit ...