---
id: CVE-2026-104704
title: >-
  Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for
  outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records
  contain no DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2
summary: >-
  Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for
  outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records
  contain no DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2. The
  server u…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-319
vendor: Progressive Robot Ltd
product: hMailServer
affected:
  - hMailServer >= 6.0.0 < 6.3.6
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T15:17:32.270'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104704'
references:
  - url: 'https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6'
    label: cve@gitlab.com
  - url: 'https://gitlab.com/hmailserver/hmailserver/-/work_items/61'
    label: cve@gitlab.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-08T14:25:34.254167Z'
ingestedAt: '2026-10-08T11:31:27.690Z'
---

## Overview

Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record set consisting of DANE-TA (usage 2) or otherwise unusable records as if no records were published, so delivery to such a host fell back to opportunistic TLS. An attacker with an active position on the network path between the server and the recipient's mail exchanger can suppress or break the STARTTLS negotiation and cause messages to be delivered in cleartext, where they can be read and modified.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.