EUVD-2026-94867
GHSA-m2j8-89fm-cxjh
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
AV:N and PR:N because no server auth is needed, AC:H because the attacker must hold a simultaneous on-path DNS and SMTP position; C:H/I:H for readable/modifiable mail, A:N as availability is unaffected.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
3DescriptionCVE.org
Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE (RFC 7672) to outbound SMTP delivery. The server's validating DNSSEC resolver treated a TLSA or MX lookup that did not complete (no answer, SERVFAIL, a malformed reply), an answer without the requested records and without an NSEC/NSEC3 proof of their absence, and an answer whose records carried no applicable RRSIG as if the recipient domain were unsigned, and from 6.2.19 it also delivered to mail exchangers taken from an unvalidated MX lookup that the DNSSEC-validated MX record set did not name. An attacker who can drop, forge or strip DNS answers on the path to the server's resolver, at the resolver, or between the resolver and the recipient domain's name servers, and who holds an active position on the SMTP path, can thereby disable DANE for a DNSSEC-signed recipient domain and cause messages to be delivered in cleartext or to a host of the attacker's choosing with an arbitrary certificate, where they can be read and modified.
AnalysisAI
Outbound SMTP delivery in Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when DANE (RFC 7672) validation cannot be completed, letting an attacker who is on-path for both DNS and SMTP silently downgrade or redirect mail addressed to DNSSEC-signed recipients. When a TLSA or MX lookup returns no answer, SERVFAIL, a malformed reply, an answer lacking NSEC/NSEC3 proof of absence, or records without an applicable RRSIG, the server treats the domain as unsigned and proceeds - and from 6.2.19 it will also deliver to mail exchangers drawn from an unvalidated MX lookup that the DNSSEC-validated MX set did not name. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the targeted recipient domain be DNSSEC-signed and publish DANE TLSA records, that outbound DANE delivery be in use by hMailServer (RFC 7672), and that the server run an affected version (6.0.0 through 6.3.5; the unvalidated-MX redirection variant requires 6.2.19 or later within that range). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional integrity/confidentiality risk rather than a mass-exploitation emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to hMailServer 6.3.6, which corrects the fail-open DANE behavior (vendor release: https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6; issue tracker: https://gitlab.com/hmailserver/hmailserver/-/work_items/64). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Progressive Robot hMailServer 6.0.0 through 6.3.5, confirm whether outbound SMTP delivery to DNSSEC-signed domains is in use, and enable logging for DNS/DANE/TLSA validation failures and outbound SMTP routing. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmailserver
View allArbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticate
Cross-site scripting in Progressive Robot hMailServer 6.3.2 through 6.3.5 can let a remote, unauthenticated attacker exe
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any loc
Heap-based buffer overflow in hMailServer 6.0.0 through 6.3.3 on Windows lets a local interactive user - with no hMailSe
Local privilege escalation in hMailServer 6.0.0 through 6.3.5 on Windows allows an authenticated local user-one with an
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 on Linux allows an attacker who already has
Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail del
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first inst
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5
DNS rebinding against Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote, unauthenticated attacker to bru
Same weakness CWE-636 – Not Failing Securely ('Failing Open')
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today