Input Validation Flaw in hMailServer by hMailServer Limited
CVE-2026-107569

7.5HIGH

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
19 October 2026

What is CVE-2026-107569?

An input validation flaw in hMailServer allows remote unauthenticated attackers to exploit the X-hMailServer-LoopCount header, leading to unlimited email forwarding loops. This vulnerability enables a malicious user to set a negative value or an oversized value, causing the server to enter a loop that can generate a massive number of queued messages. Consequently, this can exhaust server resources and halt mail service entirely, significantly impacting operational continuity. Additionally, certain actions in newer versions omit crucial limitations, exacerbating the potential for an overflow that can lead to similar disruptions.

Affected Version(s)

hMailServer 6.0.0 <= 6.3.6

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/81
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found in the hMailServer project's own security review (Progressive Robot Ltd)
.