Improper Certificate Validation in hMailServer
Affects hMailServer 6.2.25 through 6.3.7 on Windows with PostgreSQL, when the root certificate file name contains non-ASCII characters. Fixed in 6.3.8.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 6.3.8
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Windows PostgreSQL is the database A root certificate file is named by PostgreSQLSslRootCert (from 6.2.25), or by TlsCaFile under TlsMode=verify-full (from 6.3.4) when neither PostgreSQL key is set The file name has bytes outside ASCII that all also read as UTF-8
- Published
- Last modified
- Whether it needs action now or is a reference record, by fixed rules, with why. Last checked is when cve.now last re-read it.What do these mean? →
- Reference
- Last checked
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 16/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
hMailServer from Progressive Robot Ltd can be made to trust an attacker's certificate authority when it connects to its PostgreSQL database, because of how a root certificate file name is read on Windows. An attacker with low privileges who can reach the network can exploit this, and the vulnerable setup is not the default configuration.
Read the original description
Progressive Robot hMailServer 6.2.25 through 6.3.7 on Windows, with a PostgreSQL database, the connection's sslmode require, verify-ca or verify-full, and a root certificate file named by PostgreSQLSslRootCert (from 6.2.25) or, with TlsMode=verify-full and neither PostgreSQL key set, by TlsCaFile (from 6.3.4), hands the file's name to libpq as bytes in the system's ANSI code page (up to 6.3.5 as Latin-1 bytes, which on code page 1252 are the code page's own for U+00A0 to U+00FF), and libpq looks for the file by those bytes and then hands the same bytes to OpenSSL, whose file opening on Windows reads a name as UTF-8 first and opens the file at that reading when one is there. When every byte of the name outside ASCII also reads as UTF-8 - for example U+00C3 U+00A9, the bytes C3 A9 on code page 1252, which are U+00E9 in UTF-8 - the database server's certificate was checked against the file at that other name whenever one was there, which allows a local attacker who can create that file but cannot change the configured one, as any user can by default beside a file an administrator keeps under ProgramData, or beside a folder directly under the system drive's root whose permissions the administrator restricted, and who can intercept the connection to the database server or stand in for it, to have hMailServer trust a certificate authority of the attacker's own and read and modify the traffic between hMailServer and its database, the database password included; the file alone, holding no authority that issued the database server's certificate, stops hMailServer from connecting to its database. The same applies in 6.3.4 through 6.3.7 to TlsCaFile when an Oracle MySQL client library has been put in place of the bundled MariaDB Connector/C, since that client opens the file through OpenSSL in the same way; the bundled MariaDB Connector/C opens the file in the code page and is not affected, and neither are the Linux builds. The configuration is not the default: by default no root certificate file is named.
Who should check
Windows hMailServer installs on 6.2.25 to 6.3.7 that use PostgreSQL with a root certificate file set in PostgreSQLSslRootCert or TlsCaFile
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.5/10CVSS 7.5
- No patch0/5No signal
What would change the score
- Would score about 66 if added to CISA KEV
- Would score about 61 if CISA's SSVC rates exploitation active
- Would score about 23 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Windows PostgreSQL is the database A root certificate file is named by PostgreSQLSslRootCert (from 6.2.25), or by TlsCaFile under TlsMode=verify-full (from 6.3.4) when neither PostgreSQL key is set The file name has bytes outside ASCII that all also read as UTF-8Upgrade to a fixed version: 6.3.8.
Workaround: Name the root certificate file by a path in ASCII alone
Check your systems with an agent
Paste this into a coding or ops agent. It checks your systems read-only and reports a table per asset.
Check whether my systems are affected by CVE-2026-126609 (Improper Certificate Validation in hMailServer), using the cve.now data below. Rules: work read-only. Do not run exploit code, proof-of-concept scripts or scanners that send attack payloads, and do not change any configuration, package, image or deployment. Report findings only. What cve.now has for CVE-2026-126609 (entry last updated 2026-11-11): Affected: - Progressive Robot Ltd hMailServer: from 6.2.25, through 6.3.7 Fixed versions: 6.3.8. Conditions (all must be true for the bug to be hit): - Windows (source: https://gitlab.com/hmailserver/hmailserver/-/work_items/114) - PostgreSQL is the database (source: https://gitlab.com/hmailserver/hmailserver/-/work_items/114) - A root certificate file is named by PostgreSQLSslRootCert (from 6.2.25), or by TlsCaFile under TlsMode=verify-full (from 6.3.4) when neither PostgreSQL key is set (source: https://gitlab.com/hmailserver/hmailserver/-/work_items/114) - The file name has bytes outside ASCII that all also read as UTF-8 (source: https://gitlab.com/hmailserver/hmailserver/-/work_items/114) Setup: the bug needs a feature or setting that is off by default or uncommon. Check whether each asset has it on. Attacker needs: network access, low-privilege login, no user action. Workaround: Name the root certificate file by a path in ASCII alone (source: https://www.cve.org/CVERecord?id=CVE-2026-126609) CISA KEV: CVE-2026-126609 is not listed as of cve.now's last read. This KEV status is for CVE-2026-126609 only. If you also check another CVE, look up its own KEV status; never assume it from this one. How to check: - Installed software: check what is actually running, not what a repo declares. Read the version from each host, container image and Kubernetes node (the binary's version output, the OS package database, image layers), and check whether the conditions above hold there. Distribution packages may carry a backported fix under an older version number; confirm against the distribution's own advisory. Verify against the linked advisories before concluding, and cite the date you read each one: - https://gitlab.com/hmailserver/hmailserver/-/work_items/114 - https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8 - https://www.cve.org/CVERecord?id=CVE-2026-126609 Do not conclude an asset is unaffected unless you checked it and the evidence covers both its version and the conditions above. If you could not check something, mark it unknown and say what is missing. Report a table with one row per asset and these columns: Asset | Version or build | Status (affected, fixed, not applicable, unknown) | Compensating controls | Exposure (internet-facing, internal, none) | Evidence | Next action. Entry: https://cve.now/CVE-2026-126609 For follow-up questions, use the cve.now MCP server at https://mcp.cve.now/mcp (no authentication), for example get_vulnerability with id CVE-2026-126609.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Progressive Robot Ltd hMailServer
From 6.2.25 · through 6.3.7
Evidence 4
CVE record · 2
Establishes: The identifier and description.
- Record
- Record
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-126609
Is CVE-2026-126609 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
hMailServer can fail to validate the root certificate file it uses for its database connection when the file name contains non-ASCII characters. If that happens, it may trust a certificate authority an attacker controls. The attacker could then read and change traffic between hMailServer and its database, including the database password.Source: gitlab.com, cve.org
Which versions are affected by CVE-2026-126609?
hMailServer: from 6.2.25 through 6.3.7.Source: cve.now feed data
Am I affected, and how do I check?
Versions 6.2.25 through 6.3.7 on Windows that use PostgreSQL as the database. The root certificate file must be named by PostgreSQLSslRootCert (from 6.2.25), or by TlsCaFile under TlsMode=verify-full (from 6.3.4) when neither PostgreSQL key is set, and its file name must contain bytes outside ASCII that also read as UTF-8. Check the installed version and these settings in the hMailServer configuration.Source: gitlab.com, cve.org
How do I fix CVE-2026-126609?
Upgrade to hMailServer 6.3.8, which fixes this issue.Source: gitlab.com, cve.org
Why do the sources disagree?
The advisory's description calls the attack vector local, but the CVSS vector lists the attack vector as network (AV:N). The two sources do not agree on how the attack is reached.Source: gitlab.com, cve.org