Progressive Robot hMailServer: Database TLS verification failure (CVE-2026-126610)
Progressive Robot hMailServer 6.3.4 through 6.3.7, when using a MySQL or MariaDB database with TlsMode=verify-full, fails to provide the configured CA file to the database client if the filename contains specific non-ASCII or high-Unicode characters. This results in the database client performing certificate verification without the intended CA, potentially allowing an attacker who intercepts the connection to read or modify traffic.
CVE search metadata
CVE search record: CVE-2026-126610. Severity: high. CVSS: 7.4. KEV: no. Product: hMailServer (6.3.4 through 6.3.7). Brief: Progressive Robot hMailServer: Database TLS verification failure (CVE-2026-126610). Brief link: https://feed.craftedsignal.io/briefs/2026-11-hmailserver-tls-verification-cve-2026-126610/
Triage facts
Revision 1- Applicability
- hMailServer (6.3.4 through 6.3.7)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 14:03 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Progressive Robot hMailServer 6.3.4 through 6.3.7, when configured with TlsMode=verify-full and a MySQL or MariaDB database, fails to pass the TlsCaFile to the database client when the filename contains characters outside ASCII (on Linux) or above U+00FF (on Windows).
The application converts the file path using the C runtime in the C locale, resulting in an empty string and no CA file being set. Despite the lack of a CA file, certificate verification remains enabled, causing the client (MariaDB Connector/C) to verify the database server's certificate against the system's trust store instead of the configured file. This allows an attacker capable of intercepting the database connection to present a certificate from any authority or one issued for the server's name, facilitating traffic interception or modification.