Hmailserver
Monthly
Outbound SMTP delivery in Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when DANE (RFC 7672) validation cannot be completed, letting an attacker who is on-path for both DNS and SMTP silently downgrade or redirect mail addressed to DNSSEC-signed recipients. When a TLSA or MX lookup returns no answer, SERVFAIL, a malformed reply, an answer lacking NSEC/NSEC3 proof of absence, or records without an applicable RRSIG, the server treats the domain as unsigned and proceeds - and from 6.2.19 it will also deliver to mail exchangers drawn from an unvalidated MX lookup that the DNSSEC-validated MX set did not name. The result is delivery in cleartext or to an attacker-chosen host with an arbitrary certificate, where messages can be read and modified; CVSS is 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) because exploitation requires an active on-path position against both the resolver path and the mail path, and no public exploit identified at time of analysis. The vendor addressed this in release 6.3.6.
Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail delivery by sending messages crafted to look like RFC 3464 delivery status notifications or RFC 5965 abuse feedback reports whose returned-headers part begins with a very large number of blank lines. The DSN and ARF readers strip leading blank lines two bytes at a time, copying the remainder of the part on each iteration, so processing cost grows with the square of the blank-line count; a single report-shaped message within the reader's 2 MB limit can occupy a delivery thread for over a minute, and a few such messages per minute can saturate every delivery thread. Exploitation is conditional: the server must have bounce processing or complaint processing enabled, or must manage a mailing list, and the vendor states none of these is enabled by default, so a stock 6.3.4/6.3.5 installation is not exposed. There is no public exploit identified at time of analysis, no CISA KEV listing, and the impact is limited to availability of mail delivery (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no data exposure or code execution; the vendor-released fix is hMailServer 6.3.6.
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail delivery and SMTP service by sending a single crafted message. The root cause is inefficient algorithmic complexity (CWE-407) in inbound DKIM and ARC signature verification: assembling the canonical header and resolving the header names listed in a signature's h= tag grows quadratically with header size, so a message with very many header fields - or one field folded over very many continuation lines - holds a worker thread busy for tens of seconds per signature, and up to ten signatures are evaluated per message by both the DKIM and DMARC tests on the threads that serve delivery and SMTP. CVSS 3.1 rates this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity impact; no confirmed active exploitation (CISA KEV) or public exploit code was identified at time of analysis, and the vendor has published a fixed release, v6.3.6.
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make SMTP, IMAP, POP3, delivery, and REST API services unavailable by sending a crafted message. A non-terminating MIME header parsing loop pins a worker thread at full CPU until restart, but that path is only reached when the attachment blocker is configured to rename a blocked attachment or when a filename is set via the REST API; a broader quadratic-complexity path in RFC 2047/RFC 2231 header handling and repeated header deletion is reachable on default mail intake. No public exploit identified at time of analysis; vendor patch is version 6.3.6.
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any local authenticated user read the mail server's stored messages, logs, temporary files, and built-in database, because the data, log, temp, database and event folders and the hMailServer.INI file inherit the local Users group's read access from the default installation path under Program Files. The readable INI exposes the database password, which is protected only by the machine's DPAPI key and can therefore be unsealed by any local account - handing full control of an external database - while the built-in database's account password hashes become readable whenever the hMailServer service is stopped; the Linux AppImage 6.3.0 through 6.3.5 has a parallel weakness in per-user data folder permissions. Exploitation requires an untrusted local account able to sign in to the host, no public exploit was identified at time of analysis, and the vendor has released 6.3.6 as the fix.
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first instance of each duplicated member name by rescanning the members already read, so an object with N distinct names costs O(N²) - roughly 8.9 seconds for a 1 MB payload and 300 seconds for 4 MB against the affected code. An unauthenticated remote attacker can reach this reader by mailing a crafted TLS-RPT report (compressed, expanding to as much as 16 MB after decompression) to a hosted domain's published report mailbox, where it is parsed on a delivery thread; with only ten delivery threads by default, a few such reports stall all mail delivery, both local and outbound, for over an hour per report. A signed-in webmail user can deliver the same 16 MB body through the webmail's own REST routes, holding the REST API worker threads instead. There is no confirmation of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; note that unauthenticated exploitation is confined to deployments that publish a TLS-RPT report mailbox, because where none is configured the unauthenticated REST sign-in routes that read JSON are capped at 64 KB and are not affected.
Heap-based buffer overflow in hMailServer 6.0.0 through 6.3.3 on Windows lets a local interactive user - with no hMailServer account - crash the mail server service and potentially execute code in its LocalSystem security context by passing an over-long hexadecimal string to the unauthenticated COM method Utilities.BlowfishDecrypt, which copies input of arbitrary length into a fixed 255-byte heap buffer. Because exploitation requires an existing local login (CVSS AV:L/PR:L) and the only confirmed outcome is a service crash, this is an access-gated local privilege-escalation/denial-of-service issue rather than a remotely wormable emergency; no public exploit identified at time of analysis. Vendor fix is available in hMailServer 6.3.4, which contains the reference commit 135a1908ff820ed587d5f180f98c53bd010d8931.
Cross-site scripting in Progressive Robot hMailServer 6.3.2 through 6.3.5 can let a remote, unauthenticated attacker execute script in the webmail origin with a victim's session if the victim decrypts a crafted S/MIME (from 6.3.2) or OpenPGP (from 6.3.4) message and opens a text/html attachment in a new tab. The webmail is only served when the non-default REST API is enabled, and the attack requires user interaction, so realistic risk is materially lower than the 8.0 CVSS score. No public exploit was identified at time of analysis, and the vendor released v6.3.6 as a fix.
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 lets a remote peer stall outbound mail delivery by accepting a TCP/TLS connection and then sending nothing. Socket timeouts are applied in the form the Windows stack accepts but Linux refuses, and the server's HTTPS clients (MTA-STS, DANE TLSA, OAuth2, ACME) read without a deadline, so an attacker can pin worker threads indefinitely and stop delivery, ManageSieve, and metrics service for everyone else. The MTA-STS policy fetch is enabled by default and is performed during outbound delivery to mta-sts.<recipient domain>, so anyone who can make the server deliver mail to a domain they control - for example as the envelope sender of a message that bounces - can hold delivery threads until outbound mail stops; Windows builds are not affected at all. Per the authoritative assessment the vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), i.e. unauthenticated with no user interaction, but impact is bounded to availability only; no public exploit identified at time of analysis, and the fix ships in release 6.3.6.
DNS rebinding against Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote, unauthenticated attacker to brute-force the server administrator's password through the administrator's own browser when the optional REST API listener is enabled, ultimately gaining full administrative control of the mail server. Two flaws combine to enable this: the listener answers requests regardless of the Host header they carry, and failed administrator sign-ins originating from the loopback address are neither throttled nor auto-banned, so a rebound page can submit password attempts at full speed until one is accepted. Exploitation is conditional rather than casual - the REST API listener is off by default and loopback-bound when enabled, an administrator must open the attacker's page in a browser running on the server host itself, and the attacker must control DNS for a name they can rebind to 127.0.0.1; no public exploit has been identified at time of analysis.
Local privilege escalation in hMailServer 6.0.0 through 6.3.5 on Windows allows an authenticated local user-one with an interactive logon but no hMailServer credentials-to abuse COM objects to read and write arbitrary files as the service account and send mail as any sender. The service registers its COM classes without DCOM launch or access permissions and calls CoInitializeSecurity with a null security descriptor, so any user logged on at the console or over Remote Desktop can activate hMailServer.Message, Attachments, and hMailServer.FetchAccount objects. If the service runs as LocalSystem (the default), arbitrary file write can lead to code execution as SYSTEM; no public exploit identified at time of analysis.
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 on Linux allows an attacker who already has code execution as the unprivileged hmailserver service account to run arbitrary code as root via the live-update apply helper (hmailserver-update). The vulnerability requires the live-update path unit to be active, which is the default for the project's .deb and .rpm packages and applies to AppImage installations run under that unit, but does not affect non-Linux builds. No public exploit code has been identified at time of analysis, and the vendor has released version 6.3.6 to address the issue.
Outbound SMTP deliveries from hMailServer 6.0.0 through 6.3.5 can be transmitted in cleartext when the recipient mail exchanger publishes DNSSEC-validated TLSA records that contain only DANE-TA (usage 2) records or otherwise unusable records and no DANE-EE (usage 3) record, because the server incorrectly treats such a validated record set as if no DANE data existed and reverts to opportunistic TLS. An attacker holding an active on-path (MITM) position between the server and that MX can suppress or break STARTTLS and read and modify messages in transit, yielding high confidentiality and integrity impact (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4). No public exploit code was identified at time of analysis; exploitation is conditional on a non-default recipient TLSA layout plus a real-time network-path position, making this a targeted rather than broadly exploitable issue, and no user interaction or authentication is required per the assessed vector.
Arbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticated, remote attacker run attacker-controlled code inside the hMailServer service process with the service account's privileges by sending a password containing a backslash immediately followed by an apostrophe in any SMTP AUTH, POP3, or IMAP logon that names an existing active account. The flaw is only reachable in a non-default configuration - event scripting enabled (off by default), the script language set to JScript (default is the unaffected VBScript), and a relevant handler (OnClientValidatePassword, OnExternalAccountDownload, or OnDeliveryFailed) defined - and equivalent paths exist through a malicious remote POP3 server's message UID or a malicious remote SMTP server's rejection reply. The vendor's CVSS of 9.8/AV:N/AC:L understates the practical barrier because it does not model those required non-default settings; our assessed vector is AV:N/AC:H/PR:N/UI:N, no public exploit has been identified at time of analysis, and the vendor-released patch is version 6.3.4.
Denial of service in hMailServer 6.3.2 through 6.3.5 lets an unauthenticated remote attacker exhaust the webmail/REST HTTP listener by sending a message that references one small embedded image an extreme number of times, if the recipient opens it in webmail. The rendering path has quadratic work and can occupy one of four worker threads for minutes while building a multi-gigabyte document, so a few messages can make webmail, the administration console, and the REST API unavailable. No public exploit identified at time of analysis; the vendor has released 6.3.6, and this is a moderate-priority availability issue rather than a critical one.
Improper certificate validation in the hMailServer webmail S/MIME handler (versions 6.3.2 through 6.3.5) allows a remote unauthenticated attacker to have their own encryption key silently added to the recipient set of messages a victim later sends to a target correspondent, exposing those messages to anyone holding the attacker's private key. The webmail keeps the signing certificate from any opened S/MIME-signed message even when the server finds the chain untrusted, stores it under the certificate's first listed e-mail address rather than the message's From address, and appends it alongside any legitimate certificate already held for that address; the attacker still needs to independently obtain a copy of the later ciphertext (for example through mailbox or network interception) to decrypt it. Exploitation requires the S/MIME feature to be in active use and a user to open the crafted signed message, and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released hMailServer 6.3.6 as the fix.
A remote, unauthenticated attacker can degrade or fully stall Progressive Robot hMailServer (6.2.22-pre1 through 6.3.5) by sending a single HTML-only email whose body contains a very large number of character entity references, because the server's shared string class performs entity decoding with a replace/remove implementation whose cost grows with the square of the number of entities (CWE-407). The expensive decode runs only when the server builds a folder snippet - when the recipient lists the folder in webmail via the REST API (6.3.3-6.3.5) or when an IMAP client issues a PREVIEW request (6.2.22-6.3.5) - and the message never has to be opened; each such listing can pin one of the listener's four worker threads for minutes, so a handful of crafted messages leaves webmail, the administration console and the REST API unable to answer anyone. Impact is availability-only (CVSS 6.5, AV:N/AC:L/PR:N/UI:R, C:N/I:N/A:H) and depends on victim-side interaction (folder listing or PREVIEW); no public exploit code was identified at time of analysis. The vendor has released 6.3.6, which resolves the quadratic behaviour.
Authenticated IMAP users can make hMailServer 6.0.0 through 6.3.5 stop responding and consume excessive memory, because several IMAP command parsers do work that grows quadratically with the length of a command or the number of elements it names. The issue requires a valid signed-in mailbox account (CVSS PR:L, AV:N, AC:L) and causes availability impact only (A:H, no confidentiality or integrity impact, CVSS 6.5). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); a vendor fix is available in release 6.3.6.
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated sender stall the IMAP, SMTP, POP3 and webmail services by delivering a single message whose header field carries an RFC 2047 encoded word that decodes to a very large number of line breaks. The decoder unfolds such a value quadratically, so each read of the poisoned header can occupy a shared worker thread for minutes or longer; because IMAP worker threads are shared with SMTP and POP3, a handful of messages can render the mail services unresponsive. Exploitation is gated by user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5 MEDIUM): the cost is incurred when a victim's IMAP client searches, sorts or threads by a header, when webmail lists the folder, or where header-testing delivery rules, Subject spam tagging or abuse-report reading are configured. No public exploit code and no CISA KEV entry were identified at time of analysis, and the vendor has released a fixed version.
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 (fixed in 6.3.6) lets an attacker who already executes code as the low-privilege hMailServer service account ride a subsequent administrator- or root-run operation to full SYSTEM/root privileges. The flaw is improper link resolution (CWE-59): administrative command-line operations, the installer, DBSetup, the Control Panel, and store-maintenance/object-storage routines resolve file paths inside the log and data folders without guarding against junctions, mount points, or symbolic links that the service account can plant - and on Linux those maintenance routines run as root, so a planted symlink is followed with root authority. The attacker must already hold a foothold as NT SERVICE\hMailServer (Windows) or the packaged hmailserver user (Linux) and must wait for a privileged operation to be triggered, so exploitation is local-only, requires user interaction on the privileged side, and carries elevated complexity; no public exploit code or KEV-listed active exploitation was identified at time of analysis, and the CVE-org references point to the upstream work item and the v6.3.6 release.
Quadratic algorithmic complexity in the SPF macro-expansion path of hMailServer 6.3.4 and 6.3.5 allows a remote, unauthenticated attacker to consume worker-thread time by sending mail from a domain whose SPF record they control and which expands through macros to a domain name far longer than 253 characters, making each SPF check take several seconds. The attack requires SPF validation to be enabled on an inbound path and is bounded by SPF's own per-term and per-macro limits, so the resulting availability loss is partial rather than a complete outage. No public exploit code has been identified at time of analysis, and a vendor patch (6.3.6) is available; the 5.3 MEDIUM CVSS score reflects a low-to-moderate priority issue in which impact is confined to availability (C:N/I:N/A:L).
Authenticated denial of service in Progressive Robot hMailServer 6.2.24 through 6.3.5 lets any account holder who can publish an active Sieve script exhaust the server's shared delivery thread pool using their own filters. A ':matches' pattern with several wildcards evaluated against a long string, or a 'deleteheader' rule that strips many same-named fields, consumes seconds of CPU per message (44 seconds for an '*a*a*a*b' pattern over 800 characters; 18.8 seconds to remove 80,000 header fields), and a handful of self-delivered messages is enough to stall mail delivery for every user on the instance. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5) and the impact is availability only; the vendor has released 6.3.6 with fixes, and no public exploit identified at time of analysis.
Heap-based buffer overflow in hMailServer's legacy Blowfish encryption routine can crash the service, affecting Progressive Robot hMailServer versions 6.0.0 through 6.3.5. Remote exploitation requires hMailServer 6.3.4 or 6.3.5 with the non-default self-service REST API enabled and an authenticated mailbox user who creates a fetch account with a password 129-247 characters long that is not a multiple of 8 and then requests a personal data export; locally on Windows, any interactive user can reach the same routine through the COM method Utilities.BlowfishEncrypt without hMailServer authentication, and stored-secret writes are affected when ProtectStoredSecretsWithDPAPI is set to 0. No public exploit was identified at time of analysis. The CVSS 3.1 score is 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), an availability-only impact; real-world priority is lower than the base score suggests because the remote path depends on a non-default feature and the unauthenticated path requires local interactive access to the Windows host.
Outbound SMTP delivery in Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when DANE (RFC 7672) validation cannot be completed, letting an attacker who is on-path for both DNS and SMTP silently downgrade or redirect mail addressed to DNSSEC-signed recipients. When a TLSA or MX lookup returns no answer, SERVFAIL, a malformed reply, an answer lacking NSEC/NSEC3 proof of absence, or records without an applicable RRSIG, the server treats the domain as unsigned and proceeds - and from 6.2.19 it will also deliver to mail exchangers drawn from an unvalidated MX lookup that the DNSSEC-validated MX set did not name. The result is delivery in cleartext or to an attacker-chosen host with an arbitrary certificate, where messages can be read and modified; CVSS is 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) because exploitation requires an active on-path position against both the resolver path and the mail path, and no public exploit identified at time of analysis. The vendor addressed this in release 6.3.6.
Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail delivery by sending messages crafted to look like RFC 3464 delivery status notifications or RFC 5965 abuse feedback reports whose returned-headers part begins with a very large number of blank lines. The DSN and ARF readers strip leading blank lines two bytes at a time, copying the remainder of the part on each iteration, so processing cost grows with the square of the blank-line count; a single report-shaped message within the reader's 2 MB limit can occupy a delivery thread for over a minute, and a few such messages per minute can saturate every delivery thread. Exploitation is conditional: the server must have bounce processing or complaint processing enabled, or must manage a mailing list, and the vendor states none of these is enabled by default, so a stock 6.3.4/6.3.5 installation is not exposed. There is no public exploit identified at time of analysis, no CISA KEV listing, and the impact is limited to availability of mail delivery (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no data exposure or code execution; the vendor-released fix is hMailServer 6.3.6.
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail delivery and SMTP service by sending a single crafted message. The root cause is inefficient algorithmic complexity (CWE-407) in inbound DKIM and ARC signature verification: assembling the canonical header and resolving the header names listed in a signature's h= tag grows quadratically with header size, so a message with very many header fields - or one field folded over very many continuation lines - holds a worker thread busy for tens of seconds per signature, and up to ten signatures are evaluated per message by both the DKIM and DMARC tests on the threads that serve delivery and SMTP. CVSS 3.1 rates this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity impact; no confirmed active exploitation (CISA KEV) or public exploit code was identified at time of analysis, and the vendor has published a fixed release, v6.3.6.
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make SMTP, IMAP, POP3, delivery, and REST API services unavailable by sending a crafted message. A non-terminating MIME header parsing loop pins a worker thread at full CPU until restart, but that path is only reached when the attachment blocker is configured to rename a blocked attachment or when a filename is set via the REST API; a broader quadratic-complexity path in RFC 2047/RFC 2231 header handling and repeated header deletion is reachable on default mail intake. No public exploit identified at time of analysis; vendor patch is version 6.3.6.
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any local authenticated user read the mail server's stored messages, logs, temporary files, and built-in database, because the data, log, temp, database and event folders and the hMailServer.INI file inherit the local Users group's read access from the default installation path under Program Files. The readable INI exposes the database password, which is protected only by the machine's DPAPI key and can therefore be unsealed by any local account - handing full control of an external database - while the built-in database's account password hashes become readable whenever the hMailServer service is stopped; the Linux AppImage 6.3.0 through 6.3.5 has a parallel weakness in per-user data folder permissions. Exploitation requires an untrusted local account able to sign in to the host, no public exploit was identified at time of analysis, and the vendor has released 6.3.6 as the fix.
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first instance of each duplicated member name by rescanning the members already read, so an object with N distinct names costs O(N²) - roughly 8.9 seconds for a 1 MB payload and 300 seconds for 4 MB against the affected code. An unauthenticated remote attacker can reach this reader by mailing a crafted TLS-RPT report (compressed, expanding to as much as 16 MB after decompression) to a hosted domain's published report mailbox, where it is parsed on a delivery thread; with only ten delivery threads by default, a few such reports stall all mail delivery, both local and outbound, for over an hour per report. A signed-in webmail user can deliver the same 16 MB body through the webmail's own REST routes, holding the REST API worker threads instead. There is no confirmation of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; note that unauthenticated exploitation is confined to deployments that publish a TLS-RPT report mailbox, because where none is configured the unauthenticated REST sign-in routes that read JSON are capped at 64 KB and are not affected.
Heap-based buffer overflow in hMailServer 6.0.0 through 6.3.3 on Windows lets a local interactive user - with no hMailServer account - crash the mail server service and potentially execute code in its LocalSystem security context by passing an over-long hexadecimal string to the unauthenticated COM method Utilities.BlowfishDecrypt, which copies input of arbitrary length into a fixed 255-byte heap buffer. Because exploitation requires an existing local login (CVSS AV:L/PR:L) and the only confirmed outcome is a service crash, this is an access-gated local privilege-escalation/denial-of-service issue rather than a remotely wormable emergency; no public exploit identified at time of analysis. Vendor fix is available in hMailServer 6.3.4, which contains the reference commit 135a1908ff820ed587d5f180f98c53bd010d8931.
Cross-site scripting in Progressive Robot hMailServer 6.3.2 through 6.3.5 can let a remote, unauthenticated attacker execute script in the webmail origin with a victim's session if the victim decrypts a crafted S/MIME (from 6.3.2) or OpenPGP (from 6.3.4) message and opens a text/html attachment in a new tab. The webmail is only served when the non-default REST API is enabled, and the attack requires user interaction, so realistic risk is materially lower than the 8.0 CVSS score. No public exploit was identified at time of analysis, and the vendor released v6.3.6 as a fix.
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 lets a remote peer stall outbound mail delivery by accepting a TCP/TLS connection and then sending nothing. Socket timeouts are applied in the form the Windows stack accepts but Linux refuses, and the server's HTTPS clients (MTA-STS, DANE TLSA, OAuth2, ACME) read without a deadline, so an attacker can pin worker threads indefinitely and stop delivery, ManageSieve, and metrics service for everyone else. The MTA-STS policy fetch is enabled by default and is performed during outbound delivery to mta-sts.<recipient domain>, so anyone who can make the server deliver mail to a domain they control - for example as the envelope sender of a message that bounces - can hold delivery threads until outbound mail stops; Windows builds are not affected at all. Per the authoritative assessment the vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), i.e. unauthenticated with no user interaction, but impact is bounded to availability only; no public exploit identified at time of analysis, and the fix ships in release 6.3.6.
DNS rebinding against Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote, unauthenticated attacker to brute-force the server administrator's password through the administrator's own browser when the optional REST API listener is enabled, ultimately gaining full administrative control of the mail server. Two flaws combine to enable this: the listener answers requests regardless of the Host header they carry, and failed administrator sign-ins originating from the loopback address are neither throttled nor auto-banned, so a rebound page can submit password attempts at full speed until one is accepted. Exploitation is conditional rather than casual - the REST API listener is off by default and loopback-bound when enabled, an administrator must open the attacker's page in a browser running on the server host itself, and the attacker must control DNS for a name they can rebind to 127.0.0.1; no public exploit has been identified at time of analysis.
Local privilege escalation in hMailServer 6.0.0 through 6.3.5 on Windows allows an authenticated local user-one with an interactive logon but no hMailServer credentials-to abuse COM objects to read and write arbitrary files as the service account and send mail as any sender. The service registers its COM classes without DCOM launch or access permissions and calls CoInitializeSecurity with a null security descriptor, so any user logged on at the console or over Remote Desktop can activate hMailServer.Message, Attachments, and hMailServer.FetchAccount objects. If the service runs as LocalSystem (the default), arbitrary file write can lead to code execution as SYSTEM; no public exploit identified at time of analysis.
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 on Linux allows an attacker who already has code execution as the unprivileged hmailserver service account to run arbitrary code as root via the live-update apply helper (hmailserver-update). The vulnerability requires the live-update path unit to be active, which is the default for the project's .deb and .rpm packages and applies to AppImage installations run under that unit, but does not affect non-Linux builds. No public exploit code has been identified at time of analysis, and the vendor has released version 6.3.6 to address the issue.
Outbound SMTP deliveries from hMailServer 6.0.0 through 6.3.5 can be transmitted in cleartext when the recipient mail exchanger publishes DNSSEC-validated TLSA records that contain only DANE-TA (usage 2) records or otherwise unusable records and no DANE-EE (usage 3) record, because the server incorrectly treats such a validated record set as if no DANE data existed and reverts to opportunistic TLS. An attacker holding an active on-path (MITM) position between the server and that MX can suppress or break STARTTLS and read and modify messages in transit, yielding high confidentiality and integrity impact (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4). No public exploit code was identified at time of analysis; exploitation is conditional on a non-default recipient TLSA layout plus a real-time network-path position, making this a targeted rather than broadly exploitable issue, and no user interaction or authentication is required per the assessed vector.
Arbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticated, remote attacker run attacker-controlled code inside the hMailServer service process with the service account's privileges by sending a password containing a backslash immediately followed by an apostrophe in any SMTP AUTH, POP3, or IMAP logon that names an existing active account. The flaw is only reachable in a non-default configuration - event scripting enabled (off by default), the script language set to JScript (default is the unaffected VBScript), and a relevant handler (OnClientValidatePassword, OnExternalAccountDownload, or OnDeliveryFailed) defined - and equivalent paths exist through a malicious remote POP3 server's message UID or a malicious remote SMTP server's rejection reply. The vendor's CVSS of 9.8/AV:N/AC:L understates the practical barrier because it does not model those required non-default settings; our assessed vector is AV:N/AC:H/PR:N/UI:N, no public exploit has been identified at time of analysis, and the vendor-released patch is version 6.3.4.
Denial of service in hMailServer 6.3.2 through 6.3.5 lets an unauthenticated remote attacker exhaust the webmail/REST HTTP listener by sending a message that references one small embedded image an extreme number of times, if the recipient opens it in webmail. The rendering path has quadratic work and can occupy one of four worker threads for minutes while building a multi-gigabyte document, so a few messages can make webmail, the administration console, and the REST API unavailable. No public exploit identified at time of analysis; the vendor has released 6.3.6, and this is a moderate-priority availability issue rather than a critical one.
Improper certificate validation in the hMailServer webmail S/MIME handler (versions 6.3.2 through 6.3.5) allows a remote unauthenticated attacker to have their own encryption key silently added to the recipient set of messages a victim later sends to a target correspondent, exposing those messages to anyone holding the attacker's private key. The webmail keeps the signing certificate from any opened S/MIME-signed message even when the server finds the chain untrusted, stores it under the certificate's first listed e-mail address rather than the message's From address, and appends it alongside any legitimate certificate already held for that address; the attacker still needs to independently obtain a copy of the later ciphertext (for example through mailbox or network interception) to decrypt it. Exploitation requires the S/MIME feature to be in active use and a user to open the crafted signed message, and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released hMailServer 6.3.6 as the fix.
A remote, unauthenticated attacker can degrade or fully stall Progressive Robot hMailServer (6.2.22-pre1 through 6.3.5) by sending a single HTML-only email whose body contains a very large number of character entity references, because the server's shared string class performs entity decoding with a replace/remove implementation whose cost grows with the square of the number of entities (CWE-407). The expensive decode runs only when the server builds a folder snippet - when the recipient lists the folder in webmail via the REST API (6.3.3-6.3.5) or when an IMAP client issues a PREVIEW request (6.2.22-6.3.5) - and the message never has to be opened; each such listing can pin one of the listener's four worker threads for minutes, so a handful of crafted messages leaves webmail, the administration console and the REST API unable to answer anyone. Impact is availability-only (CVSS 6.5, AV:N/AC:L/PR:N/UI:R, C:N/I:N/A:H) and depends on victim-side interaction (folder listing or PREVIEW); no public exploit code was identified at time of analysis. The vendor has released 6.3.6, which resolves the quadratic behaviour.
Authenticated IMAP users can make hMailServer 6.0.0 through 6.3.5 stop responding and consume excessive memory, because several IMAP command parsers do work that grows quadratically with the length of a command or the number of elements it names. The issue requires a valid signed-in mailbox account (CVSS PR:L, AV:N, AC:L) and causes availability impact only (A:H, no confidentiality or integrity impact, CVSS 6.5). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); a vendor fix is available in release 6.3.6.
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated sender stall the IMAP, SMTP, POP3 and webmail services by delivering a single message whose header field carries an RFC 2047 encoded word that decodes to a very large number of line breaks. The decoder unfolds such a value quadratically, so each read of the poisoned header can occupy a shared worker thread for minutes or longer; because IMAP worker threads are shared with SMTP and POP3, a handful of messages can render the mail services unresponsive. Exploitation is gated by user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5 MEDIUM): the cost is incurred when a victim's IMAP client searches, sorts or threads by a header, when webmail lists the folder, or where header-testing delivery rules, Subject spam tagging or abuse-report reading are configured. No public exploit code and no CISA KEV entry were identified at time of analysis, and the vendor has released a fixed version.
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 (fixed in 6.3.6) lets an attacker who already executes code as the low-privilege hMailServer service account ride a subsequent administrator- or root-run operation to full SYSTEM/root privileges. The flaw is improper link resolution (CWE-59): administrative command-line operations, the installer, DBSetup, the Control Panel, and store-maintenance/object-storage routines resolve file paths inside the log and data folders without guarding against junctions, mount points, or symbolic links that the service account can plant - and on Linux those maintenance routines run as root, so a planted symlink is followed with root authority. The attacker must already hold a foothold as NT SERVICE\hMailServer (Windows) or the packaged hmailserver user (Linux) and must wait for a privileged operation to be triggered, so exploitation is local-only, requires user interaction on the privileged side, and carries elevated complexity; no public exploit code or KEV-listed active exploitation was identified at time of analysis, and the CVE-org references point to the upstream work item and the v6.3.6 release.
Quadratic algorithmic complexity in the SPF macro-expansion path of hMailServer 6.3.4 and 6.3.5 allows a remote, unauthenticated attacker to consume worker-thread time by sending mail from a domain whose SPF record they control and which expands through macros to a domain name far longer than 253 characters, making each SPF check take several seconds. The attack requires SPF validation to be enabled on an inbound path and is bounded by SPF's own per-term and per-macro limits, so the resulting availability loss is partial rather than a complete outage. No public exploit code has been identified at time of analysis, and a vendor patch (6.3.6) is available; the 5.3 MEDIUM CVSS score reflects a low-to-moderate priority issue in which impact is confined to availability (C:N/I:N/A:L).
Authenticated denial of service in Progressive Robot hMailServer 6.2.24 through 6.3.5 lets any account holder who can publish an active Sieve script exhaust the server's shared delivery thread pool using their own filters. A ':matches' pattern with several wildcards evaluated against a long string, or a 'deleteheader' rule that strips many same-named fields, consumes seconds of CPU per message (44 seconds for an '*a*a*a*b' pattern over 800 characters; 18.8 seconds to remove 80,000 header fields), and a handful of self-delivered messages is enough to stall mail delivery for every user on the instance. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5) and the impact is availability only; the vendor has released 6.3.6 with fixes, and no public exploit identified at time of analysis.
Heap-based buffer overflow in hMailServer's legacy Blowfish encryption routine can crash the service, affecting Progressive Robot hMailServer versions 6.0.0 through 6.3.5. Remote exploitation requires hMailServer 6.3.4 or 6.3.5 with the non-default self-service REST API enabled and an authenticated mailbox user who creates a fetch account with a password 129-247 characters long that is not a multiple of 8 and then requests a personal data export; locally on Windows, any interactive user can reach the same routine through the COM method Utilities.BlowfishEncrypt without hMailServer authentication, and stored-secret writes are affected when ProtectStoredSecretsWithDPAPI is set to 0. No public exploit was identified at time of analysis. The CVSS 3.1 score is 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), an availability-only impact; real-world priority is lower than the base score suggests because the remote path depends on a non-default feature and the unauthenticated path requires local interactive access to the Windows host.