EUVD-2026-94835
GHSA-69m7-r4p2-rfcq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated attacker simply induces delivery to a silent endpoint (AV:N/AC:L/PR:N/UI:N); only availability is lost (C:N/I:N/A:H), no scope change.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
5DescriptionCVE.org
Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery (denial of service). The server set its socket timeouts in the form Windows takes, which Linux refuses, and its HTTPS clients read without a deadline, so a peer that accepts a connection and then sends nothing held the waiting thread for as long as the connection stayed open. The MTA-STS policy fetch, enabled by default, is made during outbound delivery to mta-sts.<recipient domain>, so anyone who can make the server deliver mail to a domain they control - for example as the envelope sender of a message that bounces - can hold delivery threads until outbound delivery stops. The same flaw affects the DANE TLSA query, the OAuth2 token request, the ACME client, and the ManageSieve and metrics listeners, which a silent client stops from serving anyone else. Windows builds are not affected.
Articles & Coverage 1
AnalysisAI
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 lets a remote peer stall outbound mail delivery by accepting a TCP/TLS connection and then sending nothing. Socket timeouts are applied in the form the Windows stack accepts but Linux refuses, and the server's HTTPS clients (MTA-STS, DANE TLSA, OAuth2, ACME) read without a deadline, so an attacker can pin worker threads indefinitely and stop delivery, ManageSieve, and metrics service for everyone else. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an affected Linux build of hMailServer 6.3.0 through 6.3.5; Windows builds are not affected at all. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All exploitability signals point to a genuine, easily triggered denial-of-service, but impact is bounded to availability only. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 6.3.6 - upgrade all Linux installations of hMailServer 6.3.0 through 6.3.5 to the 6.3.6 release published at https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6, which is the definitive fix for the missing socket and read deadlines; the associated work item is https://gitlab.com/hmailserver/hmailserver/-/work_items/53. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, enumerate every Linux-based hMailServer instance running versions 6.3.0 through 6.3.5 and disable the default-enabled MTA-STS policy fetch in configuration, since it is the primary trigger path during outbound delivery; simultaneously apply or tighten read/connect deadlines on outbound HTTPS client calls (MTA-STS, DANE TLSA, OAuth2, ACME), cap and monitor concurrent delivery worker threads, and alert on outbound queue growth. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmailserver
View allArbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticate
Cross-site scripting in Progressive Robot hMailServer 6.3.2 through 6.3.5 can let a remote, unauthenticated attacker exe
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any loc
Heap-based buffer overflow in hMailServer 6.0.0 through 6.3.3 on Windows lets a local interactive user - with no hMailSe
Local privilege escalation in hMailServer 6.0.0 through 6.3.5 on Windows allows an authenticated local user-one with an
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 on Linux allows an attacker who already has
Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail del
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first inst
DNS rebinding against Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote, unauthenticated attacker to bru
Outbound SMTP delivery in Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when DANE (RFC 7672) validation c
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today