CVE-2026-114479: Not Failing Securely ('Failing Open') in hMailServer
Not failing securely in the anti-virus attachment-stripping action of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have a message that the server's virus scanner found infected delivered to the recipient's mailbox unchanged. With virus scanning enabled and its action set to remove attachments and deliver the text (the default action deletes the message), the server keeps one text part of an infected message and replaces every attachment with a note. A message whose single part is not text - a program or an archive sent as the whole message, a message carried whole, a file declared an attachment, or an S/MIME message signed as one part, whose content the recipient's mail client opens - had no part the action could pick out, and was delivered as it arrived, with the content the scanner had found and nothing but a line in the application log to show it. Any sender can write such a message.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hMailServerto a version that resolves this vulnerability.Fixed in 6.3.7 - Configuration
Set the anti-virus action to delete the whole message wherever an infected message must not be delivered.
hMailServer anti-virus action infected-message action = delete the whole message
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
hMailServer 6.0.0 through 6.3.6 is exposed when virus scanning is enabled and the anti-virus action is configured to remove attachments and deliver the text. The default action, which deletes the message, is not the affected configuration described here.
What does an attacker need to do to exploit it?
An attacker does not need authentication and can send a crafted infected email to the server. Exploitation requires the message to have a single non-text part that the recipient's mail client can open, such as a program, archive, whole-message payload, declared attachment, or single-part S/MIME-signed message.
How can administrators identify attempted or successful exploitation?
The affected server delivers the infected content unchanged and records only a line in the application log. Review application logs for infected messages processed by the attachment-stripping action, particularly where the message was delivered despite the scanner finding infected content.
What can be done if patching is not immediately possible?
Change the anti-virus action to delete infected messages rather than remove attachments and deliver text. This is the default action and avoids the affected attachment-stripping behavior.