Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107569— Unchecked Input for Loop Condition in hMailServer

Quick assessment

Affected
Progressive Robot Ltd hMailServer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Progressive Robot hMailServer 6.0.0 至 6.3.6 版本中，循环条件存在未检查的输入漏洞，允许远程未认证攻击者中断邮件服务器的正常邮件处理。该服务器在响应各类邮件操作（包括规则转发、回复或抄送、账户转发、Sieve 重定向、度假回复或通知、退信、自动外出回复等）时，会依据消息中 头字段所携带的计数器，对生成的邮件数量进行限制；一旦该计数器达到配置的规则循环上限（默认为 5），服务器将停止进一步生成邮件，从而在有限跳数内终结转发或自动回复循环。 然而， 是一个普通邮件头字段，不会从

CVSS 7.5 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
Progressive Robot Ltd hMailServer 6.0.0≤ 6.3.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107569

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unchecked Input for Loop Condition in hMailServer
Source: CVE Program / CVE List V5
Vulnerability Description
Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mail. The server bounds the mail it generates in response to a message - a rule forward, reply or copy, an account forward, a Sieve redirect, vacation or notify, a bounce, an out-of-office reply - by a counter it carries in the message's X-hMailServer-LoopCount header, and makes no more once the counter reaches the configured rule loop limit (5 by default); that is what ends a forwarding or auto-reply cycle in a bounded number of hops. X-hMailServer-LoopCount is an ordinary header that is not stripped from mail arriving from outside, and the server read it with a signed conversion and no validation, so a count below zero passed every test against the limit: a sender who sets X-hMailServer-LoopCount to a negative value, or on the Linux builds to a value above the 32-bit signed range that the conversion wraps to a negative one, lifts the bound, and a message that enters a generated-mail cycle then loops up to about two thousand million times, each hop a queued message and a delivery, filling the queue and disk and stopping mail service. The Sieve notify action (from 6.2.22) consulted no limit at all, and its increment of the count could overflow a signed integer; and an account could reset the counter on its own mail through a Sieve editheader of the header (from 6.2.22) or a rule Set header value action (all versions) ahead of a forward or redirect.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
循环条件输入未经检查
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Progressive Robot Ltd hMailServer 6.0.0 ~ 6.3.6 -

II. Public POCs for CVE-2026-107569

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107569

请登录查看更多情报信息。

Other References for CVE-2026-107569 (2)

Same Patch Batch · Progressive Robot Ltd · 2026-10-19 · 5 CVEs total

CVE-2026-107571 7.8 HIGH Incorrect Default Permissions in hMailServer
CVE-2026-107567 7.5 HIGH Use of Less Trusted Source in hMailServer
CVE-2026-107568 6.5 MEDIUM Missing Authorization in hMailServer
CVE-2026-107566 6.5 MEDIUM Missing Authorization in hMailServer

IV. Related Vulnerabilities

Same product: hMailServer
Same vendor: Progressive Robot Ltd
Same weakness: CWE-606

V. Comments for CVE-2026-107569

No comments yet

Leave a comment