hMailServer CVE-2026-114472

Exploitation requires that the target hMailServer is configured to obtain or renew TLS certificates via ACME, so that the HTTP-01 challenge responder is actively listening on port 80 and reachable by the attacker; no authentication is needed to connect. Exploitation is strongly limited by timing: the attacker's idle connections must coincide with an in-progress certificate authority validation to starve the single-connection worker, and impact only materializes if interference is sustained across renewal cycles until the certificate expires - the mail service continues on its existing certificate until then. In the fixed 6.3.7 the responder serves up to 64 simultaneous connections, so an attacker must hold 64 idle connections open at once during validation rather than a handful. Deployments not using ACME, or with the port-80 responder firewalled from untrusted networks, are not exposed.

This is a low-severity, availability-only issue and should be treated as low priority despite being remote and unauthenticated. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, base 3.7) is internally consistent with the description: network-reachable and unauthenticated (PR:N), but high complexity (AC:H) because exploitation must coincide with an in-progress ACME certificate validation, and only a limited availability impact (A:L, C:N/I:N). No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the realistic threat is a motivated attacker deliberately timing idle connections to a specific target rather than mass exploitation. The impact is also indirect and delayed - the mail service keeps running on its current certificate and only fails once the certificate actually expires after sustained interference across renewals, so there is no immediate outage. The one data-quality concern is the input tag 'Information Disclosure', which contradicts both CWE-410 (Insufficient Resource Pool / resource exhaustion) and the CVSS C:N/I:N/A:L impact - there is no confidentiality dimension to this flaw.

An attacker who knows a target hMailServer renews TLS certificates via ACME opens TCP connections to the HTTP-01 challenge responder on port 80 and sends nothing, holding the single-connection worker for the full five-second timeout each time. By keeping the responder occupied throughout a certificate authority validation window, the CA's own request is not answered in time and the renewal fails; repeated across renewal cycles the certificate eventually expires and clients refuse the server's TLS. No public exploit code is identified at time of analysis, and attack complexity is high because the attacker must sustain this across validation windows.