# CVE-2026-126613: Allocation of Resources Without Limits or Throttling in hMailServer

Status: published. Published: 2026-11-11. Updated: 2026-11-11.

Allocation of resources without limits in the JSON reader of Progressive Robot hMailServer 6.3.2 through 6.3.7 allows a remote attacker to exhaust the server's memory and hold its threads, making mail delivery, the REST API and the webmail unavailable. The reader built a tree of values far larger than the text it read, copying each value into every level above it, and set no bound on the number of values, so a single JSON document of many small values, within the 16 MB the server reads, raised the service's memory by about 2 GB and held one thread for seconds to minutes. From 6.3.4 a remote unauthenticated attacker reaches the reader by mailing such a document as a TLS-RPT report, up to 16 MB once decompressed, to a hosted domain's report mailbox, where an administrator has set one; it is read on a mail delivery thread (ten by default), and those threads deliver all mail, local and outbound. From 6.3.4 it is also reached without an account through the reply to a password-protected message, with the message's link alone, where the REST API is on (it is off by default) and a public base URL for such links is set; and by any account, from 6.3.2 through the webmail's send and draft routes and from 6.3.4 through its other routes granted 16 MB and the send API; the webmail's send, draft and settings routes parsed the body again for each member read. The REST API serves every request on four worker threads, in the process that also serves SMTP, IMAP and POP3, so a few such documents at once make it unavailable and can exhaust the machine's memory and end the whole service. This is a separate defect from CVE-2026-107574, the reader's handling of duplicate member names, fixed in 6.3.6.

## Remediation

- fix: Upgrade to hMailServer 6.3.8, whose JSON reader moves each value into its place rather than copying it, and in which a REST request body is parsed within the bounds before any handler reads it, and the shared member readers read that one parse; a REST request body is held to 100,000 values, 10,000 members in an object and 32 levels, and a mailed TLS-RPT report to 200,000 values, 10,000 members in an object and 32 levels, each refused at the first value past a bound; the reply to a password-protected message is held to 2 MB. Until then, on 6.3.4 to 6.3.7, clear each domain's report mailbox, or move it off the domains the server hosts, so that no report is read by the server; and switch OpenPGP in the webmail off (portal_enabled under /api/v1/settings/openpgp), and off for any domain or account that holds openpgp_portal_enabled on, which refuses the reply to a password-protected message before its body is parsed; clearing the public base URL is not enough, since links already made stay usable. For the routes that take an account or an API key, only limiting who can reach the REST API avoids it (RestApiPort 0, the default, turns it off), or a reverse proxy in front of it that holds request bodies well below 16 MB. Restarting the service ends a busy thread. (source: CNA: GitLab)

## Affected products and versions

- Progressive Robot Ltd / hMailServer: ≥ 6.3.2; ≤ 6.3.7 (affected, semver). Source: CNA: GitLab

## Severity and prioritization

- CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; source: CNA: GitLab

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-770

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://gitlab.com/hmailserver/hmailserver/-/work_items/110 (CNA: GitLab)

- https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8 (CNA: GitLab)

## Provenance

- CNA: GitLab: https://www.cve.org/CVERecord?id=CVE-2026-126613; retrieved 2026-11-11; source updated 2026-11-11

Revision: a392c568d691dee02519e442fb5f5d0dee7693c0f346ef1615a643c784ea099e

Canonical: https://y2.dev/cve/CVE-2026-126613

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.