CVE-2026-107584 Progressive Robot Ltd CVE debrief

Who should care

Mail server administrators and security teams responsible for implementing DANE and DNSSEC for outbound SMTP delivery should assess exposure and prioritize remediation. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified, and tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented.

Why it matters

CVE-2026-107584 allows an attacker to disable DANE for a DNSSEC-signed recipient domain, potentially leading to eavesdropping and tampering with email content. Mail server administrators and security teams should assess exposure and prioritize remediation.

• Disable DANE for DNSSEC-signed recipient domains
• Delivery of messages in cleartext
• Delivery of messages to a host of the attacker's choosing with an arbitrary certificate
• Potential for eavesdropping and tampering with email content

Technical summary

hMailServer 6.0.0 through 6.3.5 fails open when applying DANE to outbound SMTP delivery, allowing an attacker to disable DANE for a DNSSEC-signed recipient domain and cause messages to be delivered in cleartext or to a host of the attacker's choosing with an arbitrary certificate. The server's validating DNSSEC resolver treated a TLSA or MX lookup that did not complete, an answer without the requested records and without an NSEC/NSEC3 proof of their absence, and an answer whose records carried no applicable RRSIG as if the recipient domain were unsigned.

Defensive priority

High priority for mail server administrators

Recommended defensive actions

• Update hMailServer to version 6.3.6 or later
• Implement DANE and DNSSEC for outbound SMTP delivery
• Monitor DNS answers and SMTP path for potential attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability in hMailServer. The vulnerability allows an attacker to disable DANE for a DNSSEC-signed recipient domain and cause messages to be delivered in cleartext or to a host of the attacker's choosing with an arbitrary certificate.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.