CVE-2026-107583

Progressive Robot hMailServer versions 6.3.2 through 6.3.5 are vulnerable to an inefficient algorithmic complexity flaw in the webmail's message view of the REST API . A remote unauthenticated attacker can send a message containing an HTML reference to a single small embedded image a very large n...

CVE-2026-107583 Inefficient Algorithmic Complexity in hMailServer

Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders ...

CVE-2026-107582 Inefficient Algorithmic Complexity in hMailServer

Inefficient algorithmic complexity in the REST API 6.3.3 through 6.3.5 and the IMAP PREVIEW response 6.2.22 through 6.3.5 of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. To...

CVE-2026-107582 Inefficient Algorithmic Complexity in hMailServer

Inefficient algorithmic complexity in the REST API 6.3.3 through 6.3.5 and the IMAP PREVIEW response 6.2.22 through 6.3.5 of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. To...

CVE-2026-107580 Inefficient Algorithmic Complexity in hMailServer

Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the IMAP, SMTP and POP3 services, or the webmail, unavailable by sending a message. The server unfolded a decoded heade...

CVE-2026-107579 Inefficient Algorithmic Complexity in hMailServer

Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery by sending messages, when bounce processing or complaint processing is enabled or a mailing list is managed by...

CVE-2026-107576 Inefficient Algorithmic Complexity in hMailServer

Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the mail services unavailable by sending a message. Building the canonical header and choosing the header...

EUVD-2026-94857

Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels...

CVE-2026-107574

Progressive Robot hMailServer is vulnerable to a Denial of Service (DoS) attack due to inefficient algorithmic complexity (O(N^2)) in its JSON reader. The component fails to efficiently handle duplicated member names, causing significant processing delays: a 4 MB object can take 300 seconds to pr...

PT-2026-107906

Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders ...

PT-2026-108008

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to algorithmic complexity in linked-list traversal...

Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (September 2026 - Part 1 of 2)

Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2026-59869 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. From...

CentOS Linux 8 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1791261872)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1791261872 advisory. - In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading...

Rocky Linux 9.6 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-dracut / etc (ALMALINUX9.6:CLSA-2026:1791278576)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791278576 advisory. - Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in...

AlmaLinux 9.6 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-dracut / etc (ALMALINUX9.6:CLSA-2026:1791278576)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791278576 advisory. - Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in...

Where Does a Rust Speedup Come From? Language and Algorithm Effects in Sliding Window Threat Scorer

Rewriting a hot path from Python into Rust is a common way to speed up security analytics, and large speedups are routinely reported. A rewrite usually changes the language and the algorithm at once, so a single factor can credit the language with a gain that comes from a better algorithm. We stu...

The vulnerabilities in the `stream-json/jsonc/parser.js` and `stream-json/jsonc/verifier.js` libraries for processing JSON and JSONC streams allow attackers to induce service failures.

The vulnerability in the stream-json/jsonc/parser.js and stream-json/jsonc/verifier.js libraries for processing JSON and JSONC streams is related to inefficient algorithmic complexity. Exploiting this vulnerability can allow attackers to cause service failures...

stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

Summary The JSONC parser stream-json/jsonc/parser.js and verifier stream-json/jsonc/verifier.js scan a comment for its terminator starting from the comment's opening / on every input chunk. When a comment doesn't finish inside the current buffer, the scanner returns the comment's start offset and...

GHSA-HQR4-QQ8F-HG3X stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

Summary The JSONC parser stream-json/jsonc/parser.js and verifier stream-json/jsonc/verifier.js scan a comment for its terminator starting from the comment's opening / on every input chunk. When a comment doesn't finish inside the current buffer, the scanner returns the comment's start offset and...

ROS-20261005-73-0040

The vulnerability of the libexpat library for processing XML files is related to the inefficient algorithmic complexity in handling attribute names. Exploiting this vulnerability could allow a malicious actor to cause service failures...