The vulnerability stems from hMailServer’s ACME HTTP‑01 challenge responder handling only one connection at a time, waiting up to five seconds for a request. An unauthenticated attacker can connect to port 80, send no data, and keep the single worker occupied. If the server is in the middle of obtaining or renewing a TLS certificate, the delayed or missing response causes the certificate authority’s validation to fail. Over successive renewals the certificate can expire, leading to clients rejecting the server’s TLS even though the mail service continues with the old certificate. This results in a denial of trust and potential mail delivery interruptions.

Vendors and products affected are Progressive Robot Ltd’s hMailServer, specifically versions 6.0.0 through 6.3.6. Versions 6.3.7 and later mitigate the issue by allowing up to 64 simultaneous connections and closing excess idle connections.

The CVSS score of 3.7 indicates low base severity, and the EPSS score is unavailable, but the lack of required authentication and the open port make exploitation straightforward for any remote actor. While a single instance of failure is not catastrophic, repeated failures can cause certificate expiry and loss of secure mail service. The vulnerability is not listed in CISA KEV, yet the attack vector is straightforward: any host can open idle connections to the challenge port and stall the renewal process. The update to 6.3.7 significantly reduces the attack surface by limiting idle connections to 64 and closing connections beyond that limit.