Description
Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE (RFC 7672) to outbound SMTP delivery. The server's validating DNSSEC resolver treated a TLSA or MX lookup that did not complete (no answer, SERVFAIL, a malformed reply), an answer without the requested records and without an NSEC/NSEC3 proof of their absence, and an answer whose records carried no applicable RRSIG as if the recipient domain were unsigned, and from 6.2.19 it also delivered to mail exchangers taken from an unvalidated MX lookup that the DNSSEC-validated MX record set did not name. An attacker who can drop, forge or strip DNS answers on the path to the server's resolver, at the resolver, or between the resolver and the recipient domain's name servers, and who holds an active position on the SMTP path, can thereby disable DANE for a DNSSEC-signed recipient domain and cause messages to be delivered in cleartext or to a host of the attacker's choosing with an arbitrary certificate, where they can be read and modified.
Published: 2026-10-08
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Cleartext Delivery
Action: Patch Immediately
AI Analysis

Impact

The vulnerability occurs when hMailServer’s validating DNSSEC resolver treats incomplete or malformed TLSA or MX lookups as if the recipient domain were unsigned. This causes the server to fall back to cleartext delivery or to a host chosen by an attacker. An attacker who can tamper with DNS answers on the path to the resolver, or sit on the SMTP route, may disable DANE for a DNSSEC‑signed domain and route mail through an arbitrary host with an unverified certificate, enabling eavesdropping and tampering.

Affected Systems

The issue affects Progressive Robot Ltd’s hMailServer from version 6.0.0 through 6.3.5. Versions 6.3.6 and later include the patch that treats indeterminate DNSSEC responses correctly and enforces DANE security.

Risk and Exploitability

The CVSS v3.1 metric of 7.4 indicates medium‑high risk. EPSS currently unavailable, but the possibility to manipulate DNS on the server’s path, combined with the attacker’s active role on the SMTP channel, makes exploitation realistic. The vulnerability is not listed in CISA’s KEV, yet the attack surface is significant for organizations that rely on DANE protecting outbound mail.

Generated by OpenCVE AI on October 8, 2026 at 13:36 UTC.

Remediation

Vendor Solution

Upgrade to hMailServer 6.3.6, which treats an incomplete, unsigned or unproven DNSSEC answer for a TLSA or MX lookup under a signed zone as indeterminate, does not use a mail exchanger whose lookup was indeterminate, defers the delivery when none is left, delivers only to mail exchangers named by a DNSSEC-validated MX record set, and (for a host whose DNS servers are IPv6 only) asks those IPv6 servers. Until then, for each recipient domain whose mail must be protected, an SMTP route that names its mail exchangers with the connection security 'STARTTLS (required)', with remote certificate verification on (VerifyRemoteSslCertificate=1), prevents delivery in cleartext or to another host for that domain; and the server's DNS resolver should be one reached over a trusted path, such as a validating resolver on the same host.

OpenCVE Recommended Actions

  • Upgrade the hMailServer to version 6.3.6 or later to obtain the DNSSEC validation fix.
  • Configure the mail server to require STARTTLS (for example by setting the connection security to 'STARTTLS (required)') and enable remote certificate verification.
  • Ensure that the DNS resolver used by hMailServer is a local, validating resolver on a trusted network path, or otherwise connects over a secure, trusted channel.

Generated by OpenCVE AI on October 8, 2026 at 13:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Progressive Robot
Progressive Robot hmailserver
Vendors & Products Progressive Robot
Progressive Robot hmailserver

Thu, 08 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Description Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE (RFC 7672) to outbound SMTP delivery. The server's validating DNSSEC resolver treated a TLSA or MX lookup that did not complete (no answer, SERVFAIL, a malformed reply), an answer without the requested records and without an NSEC/NSEC3 proof of their absence, and an answer whose records carried no applicable RRSIG as if the recipient domain were unsigned, and from 6.2.19 it also delivered to mail exchangers taken from an unvalidated MX lookup that the DNSSEC-validated MX record set did not name. An attacker who can drop, forge or strip DNS answers on the path to the server's resolver, at the resolver, or between the resolver and the recipient domain's name servers, and who holds an active position on the SMTP path, can thereby disable DANE for a DNSSEC-signed recipient domain and cause messages to be delivered in cleartext or to a host of the attacker's choosing with an arbitrary certificate, where they can be read and modified.
Title Not Failing Securely ('Failing Open') in hMailServer
Weaknesses CWE-636
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Progressive Robot Hmailserver
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-10-08T17:34:40.561Z

Reserved: 2026-10-08T10:52:25.635Z

Link: CVE-2026-107584

cve-icon Vulnrichment

Updated: 2026-10-08T17:34:36.170Z

cve-icon NVD

Status : Deferred

Published: 2026-10-08T12:17:16.787

Modified: 2026-10-08T21:02:43.860

Link: CVE-2026-107584

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T13:45:05Z

Weaknesses
  • CWE-636

    Not Failing Securely ('Failing Open')