CVE-2026-103649

Summary

The Linux builds of Progressive Robot hMailServer are vulnerable to a denial-of-service attack due to missing network timeouts that cause server threads to hang indefinitely during outbound mail delivery. This affects all outbound email processing and can be triggered by attackers who control domains that receive mail through the server.

Exploitability

Exploitation is relatively straightforward as it requires only sending an email to a domain controlled by the attacker, which causes the server to wait indefinitely for responses from MTA-STS endpoints without proper timeouts.

Blast radius

The impact could be significant as outbound mail delivery would stop completely, affecting all users who rely on the server for sending emails, with no immediate recovery until the hanging threads are cleared or the service is restarted.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to hMailServer version 6.3.6 or later which includes the fix for missing network timeouts in Linux builds.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.