---
id: "CVE-2026-126623"
page: "https://infrastack.ai/live/CVE-2026-126623"
kind: "vulnerability"
aliases: ["CVE-2026-126623"]
title: "hMailServer: crafted JSON names stall mail delivery and REST API threads"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "hMailServer", "fixed": ["6.3.8"], "affected": "6.3.6, 6.3.7", "ecosystem": "vendor"}]
ecosystems: []
tags: ["hmailserver", "linux", "mail-server", "package", "tls-rpt", "windows"]
not_affected_if: ["no-tls-rpt-mailbox", "other-versions", "rest-api-off"]
published_at: "2026-11-11T09:17:14+00:00"
first_seen_at: "2026-11-11T09:26:48+00:00"
updated_at: "2026-11-11T09:30:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126623", "first_seen_at": "2026-11-11T09:26:48+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126623", "first_seen_at": "2026-11-11T09:30:01+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-126623", "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"]}]
exploit_sources: []
---

# hMailServer: crafted JSON names stall mail delivery and REST API threads

Link for people: https://infrastack.ai/live/CVE-2026-126623 (this .md is for agents)

The JSON reader in hMailServer 6.3.6 and 6.3.7 has a hash weakness that lets crafted member names make parsing take quadratic time. A remote attacker can hold mail delivery threads and REST API worker threads, stopping mail delivery, the REST API and webmail.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:hMailServer affected 6.3.6, 6.3.7 fixed 6.3.8

## How to check

- Check the installed hMailServer version (Windows or Linux build): 6.3.6 and 6.3.7 are listed as affected; 6.3.8 carries the JSON reader fix.
- Check whether a TLS-RPT report mailbox is set on any hosted domain (the unauthenticated mail path).
- Check whether the REST API is on (off by default) and a public base URL for password-protected message links is set.

## Fix

Upgrade to hMailServer 6.3.8 (released 2 November 2026). Its release notes say the REST API and the reader of a report mailed to a domain's report address now read JSON bodies in time and memory that follow their bytes (work items 110 and 111, CVE requested); the notes do not name CVE-2026-126623, so confirm the mapping.

## Timeline

- 2026-11-11T09:26:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126623
- 2026-11-11T09:30:01+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-126623 — NVD text read; vendor 6.3.8 release notes (gitlab) list JSON-reader fixes (work items 110/111) but do not name this CVE, so fix is not marked verified. No exploitation or PoC found. No vendor mitigation stated.

## Documents

- [advisory] NVD CVE-2026-126623 https://nvd.nist.gov/vuln/detail/CVE-2026-126623
- [fix] hMailServer 6.3.8 release notes (GitLab) https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8

## From the sources

Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer 6.3.6 and 6.3.7 allows a remote attacker to hold the server's mail delivery threads or its REST API's worker threads, making mail delivery, the REST API and the webmail unavailable. 6.3.6 fixed CVE-2026-107574, in which reading a JSON object searched the member names already read for each new name, by keeping the names in a hash set; the set uses the standard library's hash, which takes no secret, so member names chosen to fall in one bucket of it still cost time growing with the square of their number. Against the released reader, one such object of 16 MB took about 5 seconds to read in the Linux build, and one of under 6 MB about 23 seconds in the Windows build, where objects of the same sizes with other names took under a tenth of a second. A remote unauthenticated attacker reaches the reader by mailing such an object as a TLS-RPT report, up to 16 MB once decompressed, to a hosted domain's report mailbox, where an administrator has set one; it is read on a mail delivery thread (ten by default), and those threads deliver all mail, local and outbound, so a stream of such reports stops all delivery for as long as it continues. It is also reached without an account through the reply to a password-protected message, with the message's link alone, where the REST API is on (it is off by default) and a public base URL for such links is set; and by any account through the webmail's routes granted 16 MB, and by an application's API key through the send API. Each such request holds one of the REST API's four worker threads, in the process that also serves SMTP, IMAP and POP3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_