CVE-2026-114479
Received Received - Intake

Not failing securely in hMailServer anti-virus attachment-stripping

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: GitLab Inc.

Description
Not failing securely in the anti-virus attachment-stripping action of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have a message that the server's virus scanner found infected delivered to the recipient's mailbox unchanged. With virus scanning enabled and its action set to remove attachments and deliver the text (the default action deletes the message), the server keeps one text part of an infected message and replaces every attachment with a note. A message whose single part is not text - a program or an archive sent as the whole message, a message carried whole, a file declared an attachment, or an S/MIME message signed as one part, whose content the recipient's mail client opens - had no part the action could pick out, and was delivered as it arrived, with the content the scanner had found and nothing but a line in the application log to show it. Any sender can write such a message.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-114479
EUVD
EUVD-2026-107322

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progressive Robot Ltd hMailServer 6.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-636 When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-114479 is a vulnerability in hMailServer versions 6.0.0 through 6.3.6 where the anti-virus attachment-stripping feature fails to secure messages properly. When virus scanning is enabled with the action set to remove attachments, the server does not process single-part messages correctly. This allows infected attachments or malicious content to bypass removal and be delivered to recipients unchanged.

Detection Guidance

Check hMailServer logs for messages flagged by the virus scanner but delivered with attachments intact. Look for entries where the scanner detected malware but the message was still delivered. Verify if the anti-virus action is set to remove attachments (AVAction 1) instead of deleting the entire message.

Impact Analysis

This vulnerability allows attackers to send malicious content, such as infected files or malware, directly to mailboxes. Since the virus scanner fails to strip attachments from single-part messages, recipients may receive harmful content undetected. This could lead to malware infections, data breaches, or other security incidents on the recipient's system.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by allowing unauthorized access to sensitive data or malware to infiltrate systems. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A breach due to this vulnerability may result in non-compliance penalties and reputational damage.

Mitigation Strategies

Change the anti-virus action setting in hMailServer from 'remove attachments' (AVAction 1) to 'delete the entire message' (AVAction 0). Update hMailServer to version 6.3.7 or later to apply the official fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114479. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...