{"id":"CVE-2026-126623","kind":"vulnerability","aliases":["CVE-2026-126623"],"related":[],"title":"hMailServer: crafted JSON names stall mail delivery and REST API threads","description":"Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer 6.3.6 and 6.3.7 allows a remote attacker to hold the server's mail delivery threads or its REST API's worker threads, making mail delivery, the REST API and the webmail unavailable. 6.3.6 fixed CVE-2026-107574, in which reading a JSON object searched the member names already read for each new name, by keeping the names in a hash set; the set uses the standard library's hash, which takes no secret, so member names chosen to fall in one bucket of it still cost time growing with the square of their number. Against the released reader, one such object of 16 MB took about 5 seconds to read in the Linux build, and one of under 6 MB about 23 seconds in the Windows build, where objects of the same sizes with other names took under a tenth of a second. A remote unauthenticated attacker reaches the reader by mailing such an object as a TLS-RPT report, up to 16 MB once decompressed, to a hosted domain's report mailbox, where an administrator has set one; it is read on a mail delivery thread (ten by default), and those threads deliver all mail, local and outbound, so a stream of such reports stops all delivery for as long as it continues. It is also reached without an account through the reply to a password-protected message, with the message's link alone, where the REST API is on (it is off by default) and a public base URL for such links is set; and by any account through the webmail's routes granted 16 MB, and by an application's API key through the send API. Each such request holds one of the REST API's four worker threads, in the process that also serves SMTP, IMAP and POP3.","summary":"The JSON reader in hMailServer 6.3.6 and 6.3.7 has a hash weakness that lets crafted member names make parsing take quadratic time. A remote attacker can hold mail delivery threads and REST API worker threads, stopping mail delivery, the REST API and webmail.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"hMailServer","fixed":["6.3.8"],"affected":"6.3.6, 6.3.7","ecosystem":"vendor"}],"ecosystems":[],"tags":["hmailserver","linux","mail-server","package","tls-rpt","windows"],"not_affected_if":["no-tls-rpt-mailbox","other-versions","rest-api-off"],"how_to_check":"- Check the installed hMailServer version (Windows or Linux build): 6.3.6 and 6.3.7 are listed as affected; 6.3.8 carries the JSON reader fix.\n- Check whether a TLS-RPT report mailbox is set on any hosted domain (the unauthenticated mail path).\n- Check whether the REST API is on (off by default) and a public base URL for password-protected message links is set.","fix":"Upgrade to hMailServer 6.3.8 (released 2 November 2026). Its release notes say the REST API and the reader of a report mailed to a domain's report address now read JSON bodies in time and memory that follow their bytes (work items 110 and 111, CVE requested); the notes do not name CVE-2026-126623, so confirm the mapping.","status":"open","published_at":"2026-11-11T09:17:14+00:00","first_seen_at":"2026-11-11T09:26:48+00:00","triaged_at":"2026-11-11T09:28:25+00:00","updated_at":"2026-11-11T09:30:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T09:28:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"hMailServer: crafted JSON names stall mail delivery and REST API threads","impact":"medium","summary":"The JSON reader in hMailServer 6.3.6 and 6.3.7 has a hash weakness that lets crafted member names make parsing take quadratic time. A remote attacker can hold mail delivery threads and REST API worker threads, stopping mail delivery, the REST API and webmail.","audience":"businesses","category":"package","nicknames":[],"who_cares":["hmailserver","mail-server","windows","linux","tls-rpt"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"mail delivery and REST API stop until the attack stops","analyst_note":"Confirm a fixed hMailServer version and the vendor's mitigation from the NVD entry or the vendor advisory; no fix is stated in the sources.","how_to_check":"- Check the installed hMailServer version (Windows build or Linux build) against 6.3.6 and 6.3.7.\n- Confirm whether a TLS-RPT report mailbox is configured on a hosted domain.\n- Check whether the REST API is enabled and a public base URL for password-protected message links is set.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-versions","no-tls-rpt-mailbox","rest-api-off"],"who_is_affected":"hMailServer 6.3.6 and 6.3.7 are exposed to remote attackers who can send mail to a hosted domain's TLS-RPT report mailbox, which is read on mail delivery threads. The REST API path needs the API enabled and a public base URL set, and webmail and send API paths need an account or API key. Servers that do not run these versions, or that have no TLS-RPT mailbox and no REST API exposure, are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000844,"input_tokens":5002,"output_tokens":688,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm a fixed hMailServer version and the vendor's mitigation from the NVD entry or the vendor advisory; no fix is stated in the sources.","search":"'-107574':119C '-126623':14A,17A '-2026':13A,16A,118C '16':185C,246C,351C '23':204C '5':189C '6':201C '6.3.6':34B,83C,115C '6.3.7':36B,85C 'account':304C,344C 'administr':259C 'algorithm':73C 'allow':86C 'alon':319C 'alreadi':130C 'also':300C,381C 'api':10A,61B,69B,101C,110C,323C,358C,363C,372C 'applic':356C 'attack':53B,89C,229C 'base':334C 'bucket':164C 'build':196C,209C 'chosen':159C 'complex':74C 'continu':297C 'cost':168C 'craft':2A,43B 'cve':12A,15A,117C 'decompress':249C 'default':273C,330C 'deliv':277C 'deliveri':7A,57B,66B,96C,107C,269C,291C 'domain':253C 'fall':161C 'fix':116C 'four':374C 'grant':350C 'grow':170C 'hash':39B,142C,151C 'hmailserv':1A,19B,33B,82C 'hmailserver':18A 'hold':55B,91C,367C 'host':252C 'imap':384C 'ineffici':72C 'json':3A,30B,77C,124C 'keep':137C 'key':359C 'let':42B 'librari':149C 'link':318C,338C 'linux':20B,195C 'local':280C 'long':294C 'mail':6A,22B,56B,65B,95C,106C,234C,268C,279C 'mail-serv':21B 'mailbox':256C 'make':46B,105C 'mb':186C,202C,247C,352C 'member':44B,128C,157C 'messag':313C,316C 'name':4A,45B,129C,135C,139C,158C,218C 'new':134C 'number':176C 'object':125C,183C,211C,237C 'one':163C,181C,198C,262C,368C 'outbound':282C 'packag':24B 'pars':47B 'password':311C 'password-protect':310C 'pop3':386C 'process':379C 'progress':80C 'protect':312C 'public':333C 'quadrat':49B 'reach':230C,301C 'read':122C,131C,192C,265C 'reader':31B,78C,180C,232C 'releas':179C 'remot':52B,88C,227C 'repli':307C 'report':243C,255C,288C 'request':366C 'rest':9A,60B,68B,100C,109C,322C,371C 'robot':81C 'rout':349C 'rpt':27B,242C 'search':126C 'second':190C,205C,225C 'secret':155C 'send':362C 'serv':382C 'server':23B,93C 'set':143C,145C,261C,340C 'size':215C 'smtp':383C 'squar':173C 'stall':5A 'standard':148C 'still':167C 'stop':64B,289C 'stream':285C 'take':48B,153C 'ten':271C 'tenth':222C 'thread':11A,58B,63B,97C,104C,270C,276C,376C 'time':50B,169C 'tls':26B,241C 'tls-rpt':25B,240C 'took':187C,219C 'unauthent':228C 'unavail':114C 'url':335C 'use':146C 'weak':40B 'webmail':71B,113C,347C 'window':28B,208C 'without':302C 'worker':62B,103C,375C","nicknames":[],"mitigations":[],"who_affected":"hMailServer 6.3.6 and 6.3.7 are exposed to remote attackers who can send mail to a hosted domain's TLS-RPT report mailbox, which is read on mail delivery threads. The REST API path needs the API enabled and a public base URL set, and webmail and send API paths need an account or API key. Servers that do not run these versions, or that have no TLS-RPT mailbox and no REST API exposure, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["hmailserver"],"ptokens":["hmailserver"],"labels":["high","hmailserver","linux","mailserver","package","tlsrpt","windows"],"campaign_type":null,"search_a":"'-126623':14A,17A '-2026':13A,16A 'api':10A 'craft':2A 'cve':12A,15A 'deliveri':7A 'hmailserv':1A 'hmailserver':18A 'json':3A 'mail':6A 'name':4A 'rest':9A 'stall':5A 'thread':11A","search_b":"'6.3.6':34B '6.3.7':36B 'api':61B,69B 'attack':53B 'craft':43B 'deliveri':57B,66B 'hash':39B 'hmailserv':19B,33B 'hold':55B 'json':30B 'let':42B 'linux':20B 'mail':22B,56B,65B 'mail-serv':21B 'make':46B 'member':44B 'name':45B 'packag':24B 'pars':47B 'quadrat':49B 'reader':31B 'remot':52B 'rest':60B,68B 'rpt':27B 'server':23B 'stop':64B 'take':48B 'thread':58B,63B 'time':50B 'tls':26B 'tls-rpt':25B 'weak':40B 'webmail':71B 'window':28B 'worker':62B","search_c":"'-107574':119C '-2026':118C '16':185C,246C,351C '23':204C '5':189C '6':201C '6.3.6':83C,115C '6.3.7':85C 'account':304C,344C 'administr':259C 'algorithm':73C 'allow':86C 'alon':319C 'alreadi':130C 'also':300C,381C 'api':101C,110C,323C,358C,363C,372C 'applic':356C 'attack':89C,229C 'base':334C 'bucket':164C 'build':196C,209C 'chosen':159C 'complex':74C 'continu':297C 'cost':168C 'cve':117C 'decompress':249C 'default':273C,330C 'deliv':277C 'deliveri':96C,107C,269C,291C 'domain':253C 'fall':161C 'fix':116C 'four':374C 'grant':350C 'grow':170C 'hash':142C,151C 'hmailserv':82C 'hold':91C,367C 'host':252C 'imap':384C 'ineffici':72C 'json':77C,124C 'keep':137C 'key':359C 'librari':149C 'link':318C,338C 'linux':195C 'local':280C 'long':294C 'mail':95C,106C,234C,268C,279C 'mailbox':256C 'make':105C 'mb':186C,202C,247C,352C 'member':128C,157C 'messag':313C,316C 'name':129C,135C,139C,158C,218C 'new':134C 'number':176C 'object':125C,183C,211C,237C 'one':163C,181C,198C,262C,368C 'outbound':282C 'password':311C 'password-protect':310C 'pop3':386C 'process':379C 'progress':80C 'protect':312C 'public':333C 'reach':230C,301C 'read':122C,131C,192C,265C 'reader':78C,180C,232C 'releas':179C 'remot':88C,227C 'repli':307C 'report':243C,255C,288C 'request':366C 'rest':100C,109C,322C,371C 'robot':81C 'rout':349C 'rpt':242C 'search':126C 'second':190C,205C,225C 'secret':155C 'send':362C 'serv':382C 'server':93C 'set':143C,145C,261C,340C 'size':215C 'smtp':383C 'squar':173C 'standard':148C 'still':167C 'stop':289C 'stream':285C 'take':153C 'ten':271C 'tenth':222C 'thread':97C,104C,270C,276C,376C 'time':169C 'tls':241C 'tls-rpt':240C 'took':187C,219C 'unauthent':228C 'unavail':114C 'url':335C 'use':146C 'webmail':113C,347C 'window':208C 'without':302C 'worker':103C,375C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T09:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126623","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126623","severity":null,"published_at":"2026-11-11T09:17:14+00:00","modified_at":"2026-11-11T09:17:14+00:00","first_seen_at":"2026-11-11T09:26:48+00:00","fetched_at":"2026-11-11T09:26:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126623:3527","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8","severity":null,"published_at":"2026-11-11T09:30:01+00:00","modified_at":"2026-11-11T09:30:01+00:00","first_seen_at":"2026-11-11T09:30:01+00:00","fetched_at":"2026-11-11T09:30:01+00:00","note":"NVD text read; vendor 6.3.8 release notes (gitlab) list JSON-reader fixes (work items 110/111) but do not name this CVE, so fix is not marked verified. No exploitation or PoC found. No vendor mitigation stated.","cites":["https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8","https://nvd.nist.gov/vuln/detail/CVE-2026-126623"]}],"documents":[{"id":124359,"url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8","title":"hMailServer 6.3.8 release notes (GitLab)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":124360,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126623","title":"NVD CVE-2026-126623","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}