CVE-2026-114472 Progressive Robot Ltd CVE debrief

Who should care

Defenders responsible for hMailServer installations, particularly those using versions 6.0.0 through 6.3.6, should assess exposure and prioritize updates to version 6.3.7 or later.

Why it matters

Defenders should care about CVE-2026-114472 because it allows remote unauthenticated attackers to cause certificate issuance or renewal failures in hMailServer, potentially leading to TLS certificate expiration and client connectivity issues. Affected roles include system administrators and security teams responsible for hMailServer installations. The vulnerability requires verification of affected versions and exposure, and defenders should prioritize updating to version 6.3.7 or later. Evidence is based on official CVE and source item records.

• Certificate issuance or renewal failures may occur due to sustained idle connections.
• Clients may refuse the server's TLS after the certificate expires.
• The mail service itself continues on its current certificate until expiration.

Technical summary

The ACME HTTP-01 challenge responder in hMailServer 6.0.0 through 6.3.6 has an insufficient resource pool, allowing a remote unauthenticated attacker to cause a certificate issuance or renewal to fail. The responder serves one connection at a time, accepting a socket, waiting up to five seconds to receive a request, answering it, and only then accepting the next. This can lead to sustained idle connections causing certificate authority's own request to be unanswered in time, resulting in validation failures and potential certificate expiration.

Defensive priority

Defenders should prioritize updating to version 6.3.7 or later to mitigate this vulnerability.

Recommended defensive actions

• Update to version 6.3.7 or later
• Review and adjust resource pooling configurations
• Monitor certificate issuance and renewal processes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to additional information. Evidence is based on official CVE and source item records, with limitations on the scope of affected systems and potential impacts. Defenders should verify affected versions, assess exposure, and review official advisories for further guidance. The CVE Program and NIST NVD provide additional context and vulnerability assessments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.