CVE-2026-107569
Received Received - Intake

Loop Count Bypass in hMailServer

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitLab Inc.

Description
Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mail. The server bounds the mail it generates in response to a message - a rule forward, reply or copy, an account forward, a Sieve redirect, vacation or notify, a bounce, an out-of-office reply - by a counter it carries in the message's X-hMailServer-LoopCount header, and makes no more once the counter reaches the configured rule loop limit (5 by default); that is what ends a forwarding or auto-reply cycle in a bounded number of hops. X-hMailServer-LoopCount is an ordinary header that is not stripped from mail arriving from outside, and the server read it with a signed conversion and no validation, so a count below zero passed every test against the limit: a sender who sets X-hMailServer-LoopCount to a negative value, or on the Linux builds to a value above the 32-bit signed range that the conversion wraps to a negative one, lifts the bound, and a message that enters a generated-mail cycle then loops up to about two thousand million times, each hop a queued message and a delivery, filling the queue and disk and stopping mail service. The Sieve notify action (from 6.2.22) consulted no limit at all, and its increment of the count could overflow a signed integer; and an account could reset the counter on its own mail through a Sieve editheader of the header (from 6.2.22) or a rule Set header value action (all versions) ahead of a forward or redirect.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-107569
EUVD
EUVD-2026-104409

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progressive Robot Ltd hMailServer 6.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-606 The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in hMailServer 6.0.0 through 6.3.6 allows a remote attacker to cause a denial of service by exploiting improper handling of the X-hMailServer-LoopCount header. The server uses this header to limit mail loops but fails to validate it properly, allowing negative values or large numbers to bypass limits. This causes excessive message generation, filling queues and disks and stopping mail service.

Detection Guidance

Monitor mail server logs for unusually high volumes of messages or repeated loops in mail delivery. Check for abnormal values in the X-hMailServer-LoopCount header in incoming mail. Use network traffic analysis tools to detect excessive SMTP traffic or queue buildup.

Impact Analysis

An attacker could exploit this to crash your mail server by generating an unbounded number of messages, consuming all available disk space and queue capacity. This would halt legitimate email delivery and disrupt communication. The attack requires no authentication and can be triggered by sending a specially crafted email.

Mitigation Strategies

Upgrade hMailServer to version 6.3.7 or later to apply the patch. Disable or restrict Sieve notify actions if not required. Configure mail server rules to validate and sanitize the X-hMailServer-LoopCount header before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107569. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart