Lotus Domino SMTP server 4.63 through 5.08 allows remote attackers to cause a denial of service (CPU consumption) by forging an email message with the sender as bounce@127.0.0.1 (localhost) which causes Domino to enter a mail loop.