CVE-2026-107575

Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels from the left; the server did this by removing one label at a time and copying the rest of the name each time, so the work grew with the square of the expansion. An attacker who publishes an SPF record for a domain they control, with a mechanism whose domain-spec expands through macros to a name far longer than 253 characters, makes the SPF check of a message from that domain take several seconds. The expansion is bounded by SPF's own per-term and per-macro limits, so the loss of availability is partial.

• CWE-407

• https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6
• https://gitlab.com/hmailserver/hmailserver/-/work_items/74

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10755The All in One SEO WordPress plugin before 4.9.9 does not c…2.7
• CVE-2026-107565A flaw was found in luksmeta. A local attacker with administ…5.1
• CVE-2026-107570heap OOB write in convert_file_from_to() via a crafted Conte…2.5
• CVE-2026-107572Inefficient complexity in the Sieve filter evaluation of Pro…6.5
• CVE-2026-107573Incorrect default permissions in the Windows installer of Pr…7.8
• CVE-2026-107574Inefficient algorithmic complexity in the JSON reader of Pro…7.5
• CVE-2026-107576Inefficient algorithmic complexity in the inbound DKIM and A…7.5
• CVE-2026-107577Inefficient algorithmic complexity and a non-terminating loo…7.5
• CVE-2026-107578Improper link resolution and external control of file paths …6.7
• CVE-2026-107579Inefficient algorithmic complexity in the bounce and complai…7.5
• CVE-2026-10758Esri LERC is an open-source image or raster format which sup…7.5
• CVE-2026-107580Inefficient algorithmic complexity in the decoding of messag…6.5