CVE-2026-107585: medium-severity vulnerability in Progressive Robot Ltd hMailServer
Allocation of Resources Without Limits or Throttling in hMailServer
Published
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.4%
exploitation probability
0.4%top 63% of all CVEs
observed exploitation
nono source reports it
Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in challenge are reached without authentication and stored pending state in bounded tables that dropped their oldest entry when full, whoever had started it. An attacker who starts sign-ins a few times a second (about a hundred a second for passkeys) pushes every other user's pending sign-in out of the table before that user's browser returns, denying single sign-on and passkey sign-in for as long as the requests continue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Progressive Robot Ltd · hMailServerRelated CVEs — Progressive Robot Ltd hMailServer
In the same product, most dangerous first.
CVE-2026-100741CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServerEPSS 1.7%CVE-2026-107576HIGHInefficient Algorithmic Complexity in hMailServerEPSS 0.4%CVE-2026-107577HIGHLoop with Unreachable Exit Condition ('Infinite Loop') in hMailServerEPSS 0.4%CVE-2026-107574HIGHInefficient Algorithmic Complexity in hMailServerEPSS 0.4%CVE-2026-107575MEDIUMInefficient Algorithmic Complexity in hMailServerEPSS 0.4%CVE-2026-107579HIGHInefficient Algorithmic Complexity in hMailServerEPSS 0.3%