CVE-2026-107572 (GCVE-0-2026-107572)
Vulnerability from cvelistv5
Published
2026-10-08 11:46
Modified
2026-10-08 17:35
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Summary
Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the matched value's length raised to the number of wildcards, so a pattern such as '*a*a*a*b' over 800 characters took 44 seconds; and 'deleteheader' erased the fields it removed one at a time, so removing many fields of one name over a message's header cost O(N^2) (80,000 fields took 18.8 seconds). Sieve filters run on the small, shared delivery thread pool, so an account holder whose active script does this, fed a few messages they can send themselves, empties the pool and stops delivery for the whole server. The script is the account holder's own and cannot be set for another user.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Progressive Robot Ltd | hMailServer |
Version: 6.2.24 ≤ |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107572",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T17:35:04.470485Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T17:35:21.719Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "hMailServer",
"repo": "https://gitlab.com/hmailserver/hmailserver",
"vendor": "Progressive Robot Ltd",
"versions": [
{
"lessThan": "6.3.6",
"status": "affected",
"version": "6.2.24",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Found in the hMailServer project\u0027s own security review (Progressive Robot Ltd)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A \u0027:matches\u0027 pattern was matched by a backtracking descent whose time grew with the matched value\u0027s length raised to the number of wildcards, so a pattern such as \u0027*a*a*a*b\u0027 over 800 characters took 44 seconds; and \u0027deleteheader\u0027 erased the fields it removed one at a time, so removing many fields of one name over a message\u0027s header cost O(N^2) (80,000 fields took 18.8 seconds). Sieve filters run on the small, shared delivery thread pool, so an account holder whose active script does this, fed a few messages they can send themselves, empties the pool and stops delivery for the whole server. The script is the account holder\u0027s own and cannot be set for another user."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333: Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T11:46:41.080Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/75"
},
{
"url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to hMailServer 6.3.6, which matches a \u0027:matches\u0027 pattern by placing each piece once (time linear in the value times the pattern) and removes \u0027deleteheader\u0027 fields in one pass. Until then, review active Sieve scripts for \u0027:matches\u0027 patterns with several wildcards and for \u0027deleteheader\u0027, and lower the maximum message size."
}
],
"title": "Inefficient Regular Expression Complexity in hMailServer"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-107572",
"datePublished": "2026-10-08T11:46:41.080Z",
"dateReserved": "2026-10-08T10:51:25.637Z",
"dateUpdated": "2026-10-08T17:35:21.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-107572\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-08T17:35:04.470485Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-08T17:35:14.413Z\"}}], \"cna\": {\"title\": \"Inefficient Regular Expression Complexity in hMailServer\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Found in the hMailServer project\u0027s own security review (Progressive Robot Ltd)\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://gitlab.com/hmailserver/hmailserver\", \"vendor\": \"Progressive Robot Ltd\", \"product\": \"hMailServer\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2.24\", \"lessThan\": \"6.3.6\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to hMailServer 6.3.6, which matches a \u0027:matches\u0027 pattern by placing each piece once (time linear in the value times the pattern) and removes \u0027deleteheader\u0027 fields in one pass. Until then, review active Sieve scripts for \u0027:matches\u0027 patterns with several wildcards and for \u0027deleteheader\u0027, and lower the maximum message size.\"}], \"references\": [{\"url\": \"https://gitlab.com/hmailserver/hmailserver/-/work_items/75\"}, {\"url\": \"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A \u0027:matches\u0027 pattern was matched by a backtracking descent whose time grew with the matched value\u0027s length raised to the number of wildcards, so a pattern such as \u0027*a*a*a*b\u0027 over 800 characters took 44 seconds; and \u0027deleteheader\u0027 erased the fields it removed one at a time, so removing many fields of one name over a message\u0027s header cost O(N^2) (80,000 fields took 18.8 seconds). Sieve filters run on the small, shared delivery thread pool, so an account holder whose active script does this, fed a few messages they can send themselves, empties the pool and stops delivery for the whole server. The script is the account holder\u0027s own and cannot be set for another user.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1333\", \"description\": \"CWE-1333: Inefficient Regular Expression Complexity\"}]}], \"providerMetadata\": {\"orgId\": \"ceab7361-8a18-47b1-92ba-4d7d25f6715a\", \"shortName\": \"GitLab\", \"dateUpdated\": \"2026-10-08T11:46:41.080Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-107572\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-08T17:35:21.719Z\", \"dateReserved\": \"2026-10-08T10:51:25.637Z\", \"assignerOrgId\": \"ceab7361-8a18-47b1-92ba-4d7d25f6715a\", \"datePublished\": \"2026-10-08T11:46:41.080Z\", \"assignerShortName\": \"GitLab\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…