{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107584",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T17:34:29.771696Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T17:34:40.561Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "hMailServer",
          "repo": "https://gitlab.com/hmailserver/hmailserver",
          "vendor": "Progressive Robot Ltd",
          "versions": [
            {
              "lessThan": "6.3.6",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Found in the hMailServer project\u0027s own security review (Progressive Robot Ltd)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE (RFC 7672) to outbound SMTP delivery. The server\u0027s validating DNSSEC resolver treated a TLSA or MX lookup that did not complete (no answer, SERVFAIL, a malformed reply), an answer without the requested records and without an NSEC/NSEC3 proof of their absence, and an answer whose records carried no applicable RRSIG as if the recipient domain were unsigned, and from 6.2.19 it also delivered to mail exchangers taken from an unvalidated MX lookup that the DNSSEC-validated MX record set did not name. An attacker who can drop, forge or strip DNS answers on the path to the server\u0027s resolver, at the resolver, or between the resolver and the recipient domain\u0027s name servers, and who holds an active position on the SMTP path, can thereby disable DANE for a DNSSEC-signed recipient domain and cause messages to be delivered in cleartext or to a host of the attacker\u0027s choosing with an arbitrary certificate, where they can be read and modified."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-636",
              "description": "CWE-636: Not Failing Securely (\u0027Failing Open\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T11:49:16.083Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/64"
        },
        {
          "url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to hMailServer 6.3.6, which treats an incomplete, unsigned or unproven DNSSEC answer for a TLSA or MX lookup under a signed zone as indeterminate, does not use a mail exchanger whose lookup was indeterminate, defers the delivery when none is left, delivers only to mail exchangers named by a DNSSEC-validated MX record set, and (for a host whose DNS servers are IPv6 only) asks those IPv6 servers. Until then, for each recipient domain whose mail must be protected, an SMTP route that names its mail exchangers with the connection security \u0027STARTTLS (required)\u0027, with remote certificate verification on (VerifyRemoteSslCertificate=1), prevents delivery in cleartext or to another host for that domain; and the server\u0027s DNS resolver should be one reached over a trusted path, such as a validating resolver on the same host."
        }
      ],
      "title": "Not Failing Securely (\u0027Failing Open\u0027) in hMailServer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2026-107584",
    "datePublished": "2026-10-08T11:49:16.083Z",
    "dateReserved": "2026-10-08T10:52:25.635Z",
    "dateUpdated": "2026-10-08T17:34:40.561Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-107584\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-08T17:34:29.771696Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-08T17:34:36.170Z\"}}], \"cna\": {\"title\": \"Not Failing Securely (\u0027Failing Open\u0027) in hMailServer\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Found in the hMailServer project\u0027s own security review (Progressive Robot Ltd)\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://gitlab.com/hmailserver/hmailserver\", \"vendor\": \"Progressive Robot Ltd\", \"product\": \"hMailServer\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0.0\", \"lessThan\": \"6.3.6\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to hMailServer 6.3.6, which treats an incomplete, unsigned or unproven DNSSEC answer for a TLSA or MX lookup under a signed zone as indeterminate, does not use a mail exchanger whose lookup was indeterminate, defers the delivery when none is left, delivers only to mail exchangers named by a DNSSEC-validated MX record set, and (for a host whose DNS servers are IPv6 only) asks those IPv6 servers. Until then, for each recipient domain whose mail must be protected, an SMTP route that names its mail exchangers with the connection security \u0027STARTTLS (required)\u0027, with remote certificate verification on (VerifyRemoteSslCertificate=1), prevents delivery in cleartext or to another host for that domain; and the server\u0027s DNS resolver should be one reached over a trusted path, such as a validating resolver on the same host.\"}], \"references\": [{\"url\": \"https://gitlab.com/hmailserver/hmailserver/-/work_items/64\"}, {\"url\": \"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE (RFC 7672) to outbound SMTP delivery. The server\u0027s validating DNSSEC resolver treated a TLSA or MX lookup that did not complete (no answer, SERVFAIL, a malformed reply), an answer without the requested records and without an NSEC/NSEC3 proof of their absence, and an answer whose records carried no applicable RRSIG as if the recipient domain were unsigned, and from 6.2.19 it also delivered to mail exchangers taken from an unvalidated MX lookup that the DNSSEC-validated MX record set did not name. An attacker who can drop, forge or strip DNS answers on the path to the server\u0027s resolver, at the resolver, or between the resolver and the recipient domain\u0027s name servers, and who holds an active position on the SMTP path, can thereby disable DANE for a DNSSEC-signed recipient domain and cause messages to be delivered in cleartext or to a host of the attacker\u0027s choosing with an arbitrary certificate, where they can be read and modified.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-636\", \"description\": \"CWE-636: Not Failing Securely (\u0027Failing Open\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"ceab7361-8a18-47b1-92ba-4d7d25f6715a\", \"shortName\": \"GitLab\", \"dateUpdated\": \"2026-10-08T11:49:16.083Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-107584\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-08T17:34:40.561Z\", \"dateReserved\": \"2026-10-08T10:52:25.635Z\", \"assignerOrgId\": \"ceab7361-8a18-47b1-92ba-4d7d25f6715a\", \"datePublished\": \"2026-10-08T11:49:16.083Z\", \"assignerShortName\": \"GitLab\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}