Read the docs
TI-2026-69489 Aliases CVE-2026-103011

Heap buffer overflow in hMailServer Blowfish routine causes crash

Priority LOW 28CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

Progressive Robot hMailServer from 6.0.0 before 6.3.6 contains a heap-based buffer overflow (CWE-122) in its legacy Blowfish encryption routine. The padding loop writes zero bytes past the end of a fixed heap buffer when a password has a certain length. An authenticated mailbox user can crash the service, and on Windows any local interactive user can trigger the same flaw through a COM method that checks no authentication.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows an authenticated mailbox user to cause a denial of service (service crash), and possibly other unspecified impact. In 6.3.4 and 6.3.5, where the self-service REST API is enabled (it is off by default), the user does this remotely by adding a fetch account whose password is 129 to 247 characters long and not a multiple of 8, and then requesting their personal data export (GET /api/v1/me/export.zip), which encrypts that password with the legacy scheme. The same flaw is reachable on Windows by any local interactive user with no hMailServer credentials, through the COM method Utilities.BlowfishEncrypt, which checked no authentication. It is also reachable by every stored-secret write when ProtectStoredSecretsWithDPAPI is set to 0. For such a length, the routine's padding loop writes up to 7 zero bytes 2 to 232 bytes past the end of its 255-byte heap buffer. The ciphertext it returns is still correct.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00211 11th percentileScored 2026-11-07
Fix Fixed hMailServer (Progressive Robot Ltd): 6.3.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Progressive Robot LtdhMailServer6.0.0 to before 6.3.66.3.6Patch availableCNA
  • hMailServer VendorProgressive Robot Ltd Affected 6.0.0 to before 6.3.6 Fixed in 6.3.6 Patch available CNA

Remediation

The fixed version for hMailServer is 6.3.6, so upgrade to that release.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA hMailServer (Progressive Robot Ltd) Fixed in 6.3.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Progressive Robot hMailServer 6.3.6

    23 records Highest priority Priority LOW 23 LOW

    Other records, highest priority first

    • TI-2026-69567 Inefficient processing in hMailServer stalls mail deliveryPriority LOW 39
    • TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mailPriority LOW 39
    • TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of servicePriority LOW 39
    Show all 23 records →

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-103011

References

Other 2

  • TI-2026-64884 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer CVSS 3.1CRITICAL 9.8
  • TI-2026-76418 Unchecked loop limit in hMailServer lets remote attackers stop mail CVSS 3.1HIGH 7.5
  • TI-2026-69567 Inefficient processing in hMailServer stalls mail delivery CVSS 3.1HIGH 7.5
  • TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mail CVSS 3.1HIGH 7.5
  • TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of service CVSS 3.1HIGH 7.5
  • TI-2026-69562 Inefficient JSON parsing in hMailServer lets attackers halt mail CVSS 3.1HIGH 7.5
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences