Resource Limitation Vulnerability in hMailServer by Progressive Robot

CVE-2026-114472

What is CVE-2026-114472?

The hMailServer by Progressive Robot suffers from an insufficient resource pool in its HTTP-01 challenge responder. This vulnerability allows a remote unauthenticated attacker to exploit the server when it attempts to obtain or renew TLS certificates. The responder processes requests sequentially, accepting only one connection at a time up to a timeout period. If a malicious user opens multiple idle connections, the server may become unresponsive, leading to failed certificate validations. This can ultimately result in the server's TLS certificate expiring, leaving users with continued mail service under an outdated certificate while preventing legitimate TLS connections. The issue is addressed in hMailServer version 6.3.7, which improves handling by serving up to 64 connections simultaneously, significantly mitigating the risk of this attack.

References