https://feed.craftedsignal.io/products/hmailserver-6.3.4-through-6.3.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 14:03:45 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-126611-hmailserver/Wed, 11 Nov 2026 14:03:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-126611-hmailserver/A vulnerability in Progressive Robot hMailServer 6.3.4 through 6.3.7 allows a local attacker to perform a man-in-the-middle attack on database connections when configured with TlsMode=verify-full and no TlsCaFile.<p>Progressive Robot hMailServer 6.3.4 through 6.3.7, when using a MySQL or MariaDB database with TlsMode=verify-full and no TlsCaFile, does not verify the database server's certificate's issuer or name for connections treated as local by MariaDB Connector/C. This allows a local attacker to impersonate the database server, receive the database sign-in (including the password), and read or modify traffic between hMailServer and the database. This behavior is linked to MariaDB Connector/C versions 3.4.1 and later failing to validate certificates on local connections in the absence of a CA file.</p> highadvisoryhttps://feed.craftedsignal.io/briefs/2026-11-hmailserver-tls-verification-cve-2026-126610/Wed, 11 Nov 2026 14:03:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-hmailserver-tls-verification-cve-2026-126610/Progressive Robot hMailServer 6.3.4 through 6.3.7, when using a MySQL or MariaDB database with TlsMode=verify-full, fails to provide the configured CA file to the database client if the filename contains specific non-ASCII or high-Unicode characters. This results in the database client performing certificate verification without the intended CA, potentially allowing an attacker who intercepts the connection to read or modify traffic.<p>Progressive Robot hMailServer 6.3.4 through 6.3.7, when configured with TlsMode=verify-full and a MySQL or MariaDB database, fails to pass the TlsCaFile to the database client when the filename contains characters outside ASCII (on Linux) or above U+00FF (on Windows).</p> <p>The application converts the file path using the C runtime in the C locale, resulting in an empty string and no CA file being set. Despite the lack of a CA file, certificate verification remains enabled, causing the client (MariaDB Connector/C) to verify the database server's certificate against the system's trust store instead of the configured file. This allows an attacker capable of intercepting the database connection to present a certificate from any authority or one issued for the server's name, facilitating traffic interception or modification.</p> highadvisory