Cpe:2.3:a:progressive_robot:hmailserver:*:*:*:*:*:*:*:*

Progressive Robot hMailServer versions 6.3.2 through 6.3.7 contain a vulnerability in the JSON reader that allows for resource exhaustion via a specially crafted JSON document.

Progressive Robot hMailServer 6.3.4 through 6.3.7, when using a MySQL or MariaDB database with TlsMode=verify-full, fails to provide the configured CA file to the database client if the filename contains specific non-ASCII or high-Unicode characters. This results in the database client performing certificate verification without the intended CA, potentially allowing an attacker who intercepts the connection to read or modify traffic.