CVE-2026-107585— Allocation of Resources Without Limits or Throttling in hMailServer
Quick assessment
Affected
Progressive Robot Ltd hMailServer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Progressive Robot hMailServer 6.3.4 和 6.3.5 版本的 REST API 中，待处理登录表存在无限制的驱逐机制（Uncontrolled eviction），这使得远程未认证攻击者能够导致其他用户的 OpenID Connect、SAML 和 Passkey 登录失败。 启动单点登录（SSO）流程并分发 Passkey 登录挑战的路由无需认证即可访问，这些路由将待处理的登录状态存储在有限大小的表中；当表满时，无论之前是谁发起的登录请求，最旧的条目都会被移除。攻击者以每秒约
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1499 · Endpoint Denial of ServiceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.3.4< 6.3.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107585
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Allocation of Resources Without Limits or Throttling in hMailServer
Source: CVE Program / CVE List V5
Vulnerability Description
Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in challenge are reached without authentication and stored pending state in bounded tables that dropped their oldest entry when full, whoever had started it. An attacker who starts sign-ins a few times a second (about a hundred a second for passkeys) pushes every other user's pending sign-in out of the table before that user's browser returns, denying single sign-on and passkey sign-in for as long as the requests continue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.3.4 ~ 6.3.6 | - |
|
II. Public POCs for CVE-2026-107585
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107585
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-107585 (1)
Other References for CVE-2026-107585 (1)
Same Patch Batch · Progressive Robot Ltd · 2026-10-08 · 24 CVEs total
| CVE-2026-103647 | 8.0 HIGH | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hM |
| CVE-2026-103010 | 7.8 HIGH | Heap-based Buffer Overflow in hMailServer |
| CVE-2026-107573 | 7.8 HIGH | Incorrect Default Permissions in hMailServer |
| CVE-2026-104658 | 7.8 HIGH | Reliance on Untrusted Inputs in a Security Decision in hMailServer |
| CVE-2026-104660 | 7.8 HIGH | Missing Authorization in hMailServer |
| CVE-2026-107577 | 7.5 HIGH | Loop with Unreachable Exit Condition ('Infinite Loop') in hMailServer |
| CVE-2026-107574 | 7.5 HIGH | Inefficient Algorithmic Complexity in hMailServer |
| CVE-2026-107579 | 7.5 HIGH | Inefficient Algorithmic Complexity in hMailServer |
| CVE-2026-107576 | 7.5 HIGH | Inefficient Algorithmic Complexity in hMailServer |
| CVE-2026-103649 | 7.5 HIGH | Synchronous Access of Remote Resource without Timeout in hMailServer |
| CVE-2026-104659 | 7.5 HIGH | Origin Validation Error in hMailServer |
| CVE-2026-107584 | 7.4 HIGH | Not Failing Securely ('Failing Open') in hMailServer |
| CVE-2026-104704 | 7.4 HIGH | Cleartext Transmission of Sensitive Information in hMailServer |
| CVE-2026-107578 | 6.7 MEDIUM | Improper Link Resolution Before File Access ('Link Following') in hMailServer |
| CVE-2026-107583 | 6.5 MEDIUM | Inefficient Algorithmic Complexity in hMailServer |
| CVE-2026-103011 | 6.5 MEDIUM | Heap-based Buffer Overflow in hMailServer |
| CVE-2026-107572 | 6.5 MEDIUM | Inefficient Regular Expression Complexity in hMailServer |
| CVE-2026-107581 | 6.5 MEDIUM | Inefficient Algorithmic Complexity in hMailServer |
| CVE-2026-107582 | 6.5 MEDIUM | Inefficient Algorithmic Complexity in hMailServer |
| CVE-2026-107580 | 6.5 MEDIUM | Inefficient Algorithmic Complexity in hMailServer |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: hMailServer
-
CVE-2026-107586
Allocation of Resources Without Limits or Throttling in hMai -
CVE-2026-107584
Not Failing Securely ('Failing Open') in hMailServer -
CVE-2026-107583
Inefficient Algorithmic Complexity in hMailServer -
CVE-2026-107587
Improper Certificate Validation in hMailServer -
CVE-2026-107582
Inefficient Algorithmic Complexity in hMailServer
Same vendor: Progressive Robot Ltd
-
CVE-2026-107586
Allocation of Resources Without Limits or Throttling in hMai -
CVE-2026-107584
Not Failing Securely ('Failing Open') in hMailServer -
CVE-2026-107583
Inefficient Algorithmic Complexity in hMailServer -
CVE-2026-107587
Improper Certificate Validation in hMailServer -
CVE-2026-107582
Inefficient Algorithmic Complexity in hMailServer
Same weakness: CWE-770
-
CVE-2026-78399
Security vulnerabilities have been found in IBM Verify Ident -
CVE-2026-107386
amqp091-go: Pre-negotiation frame limit is not enforced to 4 -
CVE-2026-107379
enshrined/svg-sanitize: Denial of Service via DTD Attribute -
CVE-2026-107586
Allocation of Resources Without Limits or Throttling in hMai -
CVE-2026-16176
IBM DataPower Gateway Denial of Service
V. Comments for CVE-2026-107585
No comments yet