Inefficient Algorithmic Complexity in SPF Macro Expansion in Progressive Robot hMailServer
CVE-2026-107575

5.3MEDIUM

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
8 October 2026

What is CVE-2026-107575?

An identified vulnerability in Progressive Robot hMailServer involves inefficient algorithmic complexity during SPF macro expansion, which can be exploited by remote unauthenticated attackers. By publishing a specially crafted SPF record containing a lengthy mechanism that expands through macros, an attacker can cause prolonged processing times when verifying email messages. This inefficiency arises because the server methodically removes labels one at a time, leading to a quadratic increase in processing time. Although the resulting loss of availability is limited due to restrictions laid out by the SPF specification, it can still significantly impact server performance.

Affected Version(s)

hMailServer 6.3.4 < 6.3.6

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/74
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found in the hMailServer project's own security review (Progressive Robot Ltd)
.