39 matches found
EUVD-2026-101754
Nodemailer: Quadratic On^2 DKIM header unfolding lets a large folded header cause remote denial of service during signing...
CVE-2026-107567
Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With...
CVE-2026-107568
Missing authorization in the Sieve notify action 6.2.22 through 6.3.6 and in the mail-rule Reply action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag...
EUVD-2026-104407
Missing authorization in the Sieve notify action 6.2.22 through 6.3.6 and in the mail-rule Reply action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag...
CVE-2026-107568
Progressive Robot hMailServer versions 6.2.22 through 6.3.6 are vulnerable to a missing authorization flaw in the Sieve notify action and the mail-rule Reply action. An authenticated user can craft a script or rule to send mail from any address because the server fails to verify if the specified ...
CVE-2026-107568 Missing Authorization in hMailServer
Missing authorization in the Sieve notify action 6.2.22 through 6.3.6 and in the mail-rule Reply action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag...
CVE-2026-107568 Missing Authorization in hMailServer
Missing authorization in the Sieve notify action 6.2.22 through 6.3.6 and in the mail-rule Reply action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag...
EUVD-2026-104406
Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With...
CVE-2026-107567
Progressive Robot hMailServer versions 6.0.0 through 6.3.6 are vulnerable to a Use of Less Trusted Source (CWE-348) issue in the DKIM signing process. A remote unauthenticated attacker can send inbound mail with a forged From header belonging to a hosted domain. If DKIM signing is enabled, the se...
CVE-2026-107567 Use of Less Trusted Source in hMailServer
Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With...
CVE-2026-107567 Use of Less Trusted Source in hMailServer
Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With...
CVE-2026-107567: Use of Less Trusted Source
Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With...
CVE-2026-107568: Missing Authorization
Missing authorization in the Sieve notify action 6.2.22 through 6.3.6 and in the mail-rule Reply action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag...
PT-2026-117455
Name of the Vulnerable Software and Affected Versions hMailServer versions 6.2.22 through 6.3.6 hMailServer versions 6.0.0 through 6.3.6 Description Missing authorization in the Sieve notify action and the mail-rule Reply action allows an authenticated user to send emails through the server using...
Inefficient Algorithmic Complexity
Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the parseHeaders method of MessageParser in src/dkim/message-parser.ts, whose unfold loop appends each...
Inefficient Algorithmic Complexity
Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the parseHeaders method of MessageParser in src/dkim/message-parser.ts, whose unfold loop appends each continuation line...
GHSA-WXXX-R42M-9RP8 Duplicate Advisory: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-39m8-27wv-hr27. This link is maintained to preserve external references. Original Description Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that...
Duplicate Advisory: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-39m8-27wv-hr27. This link is maintained to preserve external references. Original Description Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that...
PT-2026-122899
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-39m8-27wv-hr27. This link is maintained to preserve external references. Original Description Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that...
UBUNTU-CVE-2026-110871
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines,...