CVE-2026-103649 Progressive Robot Ltd CVE debrief

Who should care

Defenders responsible for Linux-based hMailServer instances, especially those handling outbound mail delivery, should assess their exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-103649 allows remote attackers to cause denial of service via missing network timeouts in Linux-based hMailServer instances. Defenders should prioritize verifying exposure and assessing impact on mail delivery services.

• Potential denial-of-service attacks on mail delivery services
• Impact on outbound mail delivery due to missing network timeouts
• Need for verification of Linux-based hMailServer instances
• Potential disruption of mail delivery services

Technical summary

The Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 are vulnerable to a denial-of-service attack due to missing network timeouts. A remote attacker can hold server threads indefinitely, stopping outbound mail delivery. The server set its socket timeouts in the form Windows takes, which Linux refuses, and its HTTPS clients read without a deadline, so a peer that accepts a connection and then sends nothing held the waiting thread for as long as the connection stayed open. The MTA-STS policy fetch, enabled by default, is made during outbound delivery to mta-sts.<recipient domain>, so anyone who can make the server deliver mail to a domain they control - for example as the envelope sender of a -b

Defensive priority

Defenders should prioritize verifying exposure of Linux-based hMailServer instances, especially those handling outbound mail delivery, and assess the impact of missing network timeouts on their mail delivery services.

Recommended defensive actions

• Verify Linux-based hMailServer instances for exposure to potential denial-of-service attacks
• Assess the impact of missing network timeouts on mail delivery services
• Update to version 6.3.6 or later to address the vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on potential exploitation or affected deployments. Further verification is required to determine the actual impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.