EUVD-2026-94838
GHSA-46vr-9694-qxgc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Scored for the stated remote REST path: authenticated mailbox user (PR:L), reliable length-based trigger (AC:L), crash-only impact (A:H) with no confidentiality/integrity effect since only zero bytes are written.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
5DescriptionCVE.org
Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows an authenticated mailbox user to cause a denial of service (service crash), and possibly other unspecified impact. In 6.3.4 and 6.3.5, where the self-service REST API is enabled (it is off by default), the user does this remotely by adding a fetch account whose password is 129 to 247 characters long and not a multiple of 8, and then requesting their personal data export (GET /api/v1/me/export.zip), which encrypts that password with the legacy scheme. The same flaw is reachable on Windows by any local interactive user with no hMailServer credentials, through the COM method Utilities.BlowfishEncrypt, which checked no authentication. It is also reachable by every stored-secret write when ProtectStoredSecretsWithDPAPI is set to 0. For such a length, the routine's padding loop writes up to 7 zero bytes 2 to 232 bytes past the end of its 255-byte heap buffer. The ciphertext it returns is still correct.
AnalysisAI
Heap-based buffer overflow in hMailServer's legacy Blowfish encryption routine can crash the service, affecting Progressive Robot hMailServer versions 6.0.0 through 6.3.5. Remote exploitation requires hMailServer 6.3.4 or 6.3.5 with the non-default self-service REST API enabled and an authenticated mailbox user who creates a fetch account with a password 129-247 characters long that is not a multiple of 8 and then requests a personal data export; locally on Windows, any interactive user can reach the same routine through the COM method Utilities.BlowfishEncrypt without hMailServer authentication, and stored-secret writes are affected when ProtectStoredSecretsWithDPAPI is set to 0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Remote path (CVSS network vector) requires ALL of: hMailServer version 6.3.4 or 6.3.5; the self-service REST API explicitly enabled (OFF by default); an authenticated mailbox user; and a fetch account password 129-247 characters long that is not a multiple of 8, exported via GET /api/v1/me/export.zip. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a medium-severity (CVSS 6.5) availability-only flaw whose real-world priority is lower than the base score suggests once the exploitation preconditions are weighed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to hMailServer 6.3.6 or later, as provided at https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6 and tracked by https://gitlab.com/hmailserver/hmailserver/-/work_items/49. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today