EUVD-2026-94831
GHSA-gv77-q2r2-h9qj
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable and unauthenticated (AV:N/PR:N/UI:N) but gated by an on-path position plus a specific recipient TLSA layout (AC:H); cleartext exposure permits reading and modifying mail (C:H/I:H) with no availability impact.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
3DescriptionCVE.org
Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record set consisting of DANE-TA (usage 2) or otherwise unusable records as if no records were published, so delivery to such a host fell back to opportunistic TLS. An attacker with an active position on the network path between the server and the recipient's mail exchanger can suppress or break the STARTTLS negotiation and cause messages to be delivered in cleartext, where they can be read and modified.
AnalysisAI
Outbound SMTP deliveries from hMailServer 6.0.0 through 6.3.5 can be transmitted in cleartext when the recipient mail exchanger publishes DNSSEC-validated TLSA records that contain only DANE-TA (usage 2) records or otherwise unusable records and no DANE-EE (usage 3) record, because the server incorrectly treats such a validated record set as if no DANE data existed and reverts to opportunistic TLS. An attacker holding an active on-path (MITM) position between the server and that MX can suppress or break STARTTLS and read and modify messages in transit, yielding high confidentiality and integrity impact (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete prerequisites: (1) hMailServer 6.0.0-6.3.5 performing outbound SMTP delivery with DANE/DNSSEC validation in use; (2) the recipient mail exchanger must publish DNSSEC-validated TLSA records containing only DANE-TA (usage 2) records or otherwise-unusable records and no DANE-EE (usage 3) record - this specific TLSA configuration is what triggers the faulty fallback to opportunistic TLS; and (3) the attacker must hold an active on-path (MITM) position between the server and that MX to suppress or break STARTTLS. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and point to a credible but conditional, not emergency, priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade hMailServer to 6.3.6 or later, available from the release page at https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6, which addresses the incorrect DANE handling tracked in https://gitlab.com/hmailserver/hmailserver/-/work_items/61; this is the primary and definitive fix and should be applied to every 6.0.0-6.3.5 instance that performs outbound delivery. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
No vendor-released patch identified at time of analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmailserver
View allArbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticate
Cross-site scripting in Progressive Robot hMailServer 6.3.2 through 6.3.5 can let a remote, unauthenticated attacker exe
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any loc
Heap-based buffer overflow in hMailServer 6.0.0 through 6.3.3 on Windows lets a local interactive user - with no hMailSe
Local privilege escalation in hMailServer 6.0.0 through 6.3.5 on Windows allows an authenticated local user-one with an
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 on Linux allows an attacker who already has
Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail del
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first inst
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5
DNS rebinding against Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote, unauthenticated attacker to bru
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today