CVE-2026-103649 Synchronous Access of Remote Resource without Timeout in hMailServer

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...

CVE-2026-103649 Synchronous Access of Remote Resource without Timeout in hMailServer

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...

EUVD-2026-94835

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...

CVE-2026-104659 Origin Validation Error in hMailServer

Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding...

EUVD-2026-94834

Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding...

CVE-2026-104659

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 are vulnerable to a remote brute-force attack on the administrator password due to missing Host header validation and a lack of throttling on failed sign-ins within the REST API listener. While the listener is off by default and bound to ...

CVE-2026-104659 Origin Validation Error in hMailServer

Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding...

CVE-2026-104660

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 (Windows) are vulnerable to a missing authorization flaw in its COM objects. The service registers COM classes without DCOM access or launch permissions and fails to use a security descriptor during CoInitializeSecurity, allowing local in...

EUVD-2026-94833

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

CVE-2026-104660 Missing Authorization in hMailServer

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

CVE-2026-104660 Missing Authorization in hMailServer

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

CVE-2026-104658

Progressive Robot hMailServer versions 6.3.4 and 6.3.5 are vulnerable to a privilege escalation flaw in the hmailserver-update helper. The helper runs as root but processes a request file written by the unprivileged hmailserver service account. It improperly uses the program path for AppImage sig...

CVE-2026-104658 Reliance on Untrusted Inputs in a Security Decision in hMailServer

The Linux live-update apply helper hmailserver-update of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit ...

CVE-2026-104658 Reliance on Untrusted Inputs in a Security Decision in hMailServer

The Linux live-update apply helper hmailserver-update of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit ...

EUVD-2026-94832

The Linux live-update apply helper hmailserver-update of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit ...

CVE-2026-104704 Cleartext Transmission of Sensitive Information in hMailServer

Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE usage 3 record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record s...

CVE-2026-104704 Cleartext Transmission of Sensitive Information in hMailServer

Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE usage 3 record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record s...

CVE-2026-104704

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 are vulnerable to a flaw where the server fails to enforce TLS for outbound SMTP delivery when DNSSEC-validated TLSA records lack a DANE-EE (usage 3) record. Instead of strictly adhering to RFC 7672, the server treats certain unusable rec...

EUVD-2026-94831

Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE usage 3 record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record s...

CVE-2026-104658: Reliance on Untrusted Inputs in a Security Decision

The Linux live-update apply helper hmailserver-update of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit ...