Description
Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record set consisting of DANE-TA (usage 2) or otherwise unusable records as if no records were published, so delivery to such a host fell back to opportunistic TLS. An attacker with an active position on the network path between the server and the recipient's mail exchanger can suppress or break the STARTTLS negotiation and cause messages to be delivered in cleartext, where they can be read and modified.
Published: 2026-10-08
Score: 7.4 High
EPSS: n/a
KEV: No
Impact: Cleartext Transmission of Sensitive Information
Action: Patch Now
AI Analysis

Impact

The vulnerability allows an attacker on the network path between an hMailServer instance and a recipient's mail exchanger to suppress or break the STARTTLS negotiation, resulting in messages being sent in cleartext. Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to hosts whose DNSSEC‑validated TLSA set contains no DANE‑EE record, causing the server to fall back to opportunistic TLS. This defect violates RFC 7672 section 2.2 and is a classic CWE‑319 problem, exposing message contents to eavesdropping or modification.

Affected Systems

Vendors: Progressive Robot Ltd. Products: hMailServer 6.0.0 through 6.3.5. Versions older than 6.3.6 are affected. No other versions are impacted.

Risk and Exploitability

The CVSS v3.1 score of 7.4 classifies the vulnerability as high severity. Exploitation requires an attacker to position themselves on the network path between the mail server and the recipient's mail exchanger; no privileged access to the server is necessary. The EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating no widespread exploitation observed yet. Nevertheless, the risk remains high for any environment that sends mail to domains whose TLSA sets lack DANE‑EE records.

Generated by OpenCVE AI on October 8, 2026 at 12:37 UTC.

Remediation

Vendor Solution

Upgrade to hMailServer 6.3.6, which verifies DANE-TA as well as DANE-EE records and requires TLS to a host whose validated TLSA records are all unusable. Until then, an SMTP route for each recipient domain concerned that names its mail exchangers with the connection security 'STARTTLS (required)' prevents delivery in cleartext to that domain.

OpenCVE Recommended Actions

  • Upgrade to hMailServer 6.3.6 or later, which enforces TLS when TLSA records are unusable.
  • If an upgrade is not immediately possible, configure an SMTP route for each affected recipient domain that requires STARTTLS, ensuring that mail delivery to that domain uses TLS.
  • Verify that the recipient's mail exchanger publishes TLSA records and that the server correctly validates them before sending mail; avoid relying on opportunistic TLS to any host with only DANE‑TA or unusable records.

Generated by OpenCVE AI on October 8, 2026 at 12:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Progressive Robot
Progressive Robot hmailserver
Vendors & Products Progressive Robot
Progressive Robot hmailserver

Thu, 08 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Description Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record set consisting of DANE-TA (usage 2) or otherwise unusable records as if no records were published, so delivery to such a host fell back to opportunistic TLS. An attacker with an active position on the network path between the server and the recipient's mail exchanger can suppress or break the STARTTLS negotiation and cause messages to be delivered in cleartext, where they can be read and modified.
Title Cleartext Transmission of Sensitive Information in hMailServer
Weaknesses CWE-319
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Progressive Robot Hmailserver
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-10-08T14:25:42.915Z

Reserved: 2026-10-02T10:10:21.800Z

Link: CVE-2026-104704

cve-icon Vulnrichment

Updated: 2026-10-08T14:25:39.723Z

cve-icon NVD

Status : Received

Published: 2026-10-08T11:16:44.457

Modified: 2026-10-08T15:17:32.270

Link: CVE-2026-104704

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T12:45:18Z

Weaknesses
  • CWE-319

    Cleartext Transmission of Sensitive Information