CVE-2026-104704: Cleartext Transmission of Sensitive Information in hMailServer
Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record set consisting of DANE-TA (usage 2) or otherwise unusable records as if no records were published, so delivery to such a host fell back to opportunistic TLS. An attacker with an active position on the network path between the server and the recipient's mail exchanger can suppress or break the STARTTLS negotiation and cause messages to be delivered in cleartext, where they can be read and modified.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progressive Robot hMailServerto a version that resolves this vulnerability.Fixed in 6.3.6 - Configuration
For each recipient domain concerned, configure an SMTP route that names its mail exchangers and sets connection security to STARTTLS (required) to prevent cleartext delivery.
hMailServer SMTP route connection security = STARTTLS (required)
Event History
Frequently Asked Questions
Which outbound deliveries are exposed?
The issue affects outbound SMTP delivery from hMailServer 6.0.0 through 6.3.5 when the recipient mail exchanger has DNSSEC-validated TLSA records but none is a DANE-EE record (usage 3). This includes record sets containing DANE-TA records (usage 2) or other records hMailServer treats as unusable.
What does an attacker need to exploit this?
An attacker needs an active position on the network path between the hMailServer instance and the recipient's mail exchanger. They must be able to suppress or disrupt STARTTLS negotiation so that delivery falls back to cleartext.
What is the impact if exploitation succeeds?
Messages delivered over the affected connection can be sent in cleartext. An on-path attacker can read and modify those messages.
What version resolves the affected range?
The affected range ends at hMailServer 6.3.5, and the provided release reference is for v6.3.6.