CVE-2026-103649 Synchronous Access of Remote Resource without Timeout in hMailServer
Remote attackers can cause denial of service in hMailServer Linux builds by holding server threads indefinitely via missing network timeouts during outbound mail delivery.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-103649?
CVE-2026-103649 is a high-severity denial of service vulnerability in Progressive Robot Ltd hMailServer, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery (denial of service). The server set its socket timeouts in the form Windows takes, which Linux refuses, and its HTTPS clients read without a deadline, so a peer that accepts a connection and then sends nothing held the waiting thread for as long as the connection stayed open. The MTA-STS policy fetch, enabled by default, is made during outbound delivery to mta-sts.<recipient domain>, so anyone who can make the server deliver mail to a domain they control - for example as the envelope sender of a message that bounces - can hold delivery threads until outbound delivery stops. The same flaw affects the DANE TLSA query, the OAuth2 token request, the ACME client, and the ManageSieve and metrics listeners, which a silent client stops from serving anyone else. Windows builds are not affected.
Weakness: CWE-1088
Which versions are affected by CVE-2026-103649?
How do I fix CVE-2026-103649?
No fix has been published for CVE-2026-103649 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-103649 being exploited?
There is no known exploitation of CVE-2026-103649 in the wild and no public exploit code.
Sources
Also known as GHSA-69m7-r4p2-rfcq.