{"id":"CVE-2026-107575","summary":"Inefficient Algorithmic Complexity in hMailServer","details":"Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels from the left; the server did this by removing one label at a time and copying the rest of the name each time, so the work grew with the square of the expansion. An attacker who publishes an SPF record for a domain they control, with a mechanism whose domain-spec expands through macros to a name far longer than 253 characters, makes the SPF check of a message from that domain take several seconds. The expansion is bounded by SPF's own per-term and per-macro limits, so the loss of availability is partial.","modified":"2026-10-10T02:47:27.638935579Z","published":"2026-10-08T11:46:46.082Z","database_specific":{"cwe_ids":["CWE-407"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107575.json","cna_assigner":"GitLab"},"references":[{"type":"WEB","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6"},{"type":"WEB","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/74"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107575.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107575"},{"type":"PACKAGE","url":"https://gitlab.com/hmailserver/hmailserver"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/hmailserver/hmailserver","events":[{"introduced":"51e2dbda08d6aa7fcda5a48f1af05221809f78be"},{"fixed":"e3c448aa66fc310b74d076884d54fae951296915"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"6.3.4"},{"fixed":"6.3.6"}]}}],"versions":["v6.3.5","v6.3.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107575.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}