{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-104704",
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "state": "PUBLISHED",
        "assignerShortName": "GitLab",
        "dateReserved": "2026-10-02T10:10:21.800Z",
        "datePublished": "2026-10-08T10:52:40.630Z",
        "dateUpdated": "2026-10-08T10:52:40.630Z"
    },
    "containers": {
        "cna": {
            "title": "Cleartext Transmission of Sensitive Information in hMailServer",
            "descriptions": [
                {
                    "lang": "en",
                    "value": "Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record set consisting of DANE-TA (usage 2) or otherwise unusable records as if no records were published, so delivery to such a host fell back to opportunistic TLS. An attacker with an active position on the network path between the server and the recipient's mail exchanger can suppress or break the STARTTLS negotiation and cause messages to be delivered in cleartext, where they can be read and modified."
                }
            ],
            "affected": [
                {
                    "vendor": "Progressive Robot Ltd",
                    "product": "hMailServer",
                    "repo": "https://gitlab.com/hmailserver/hmailserver",
                    "versions": [
                        {
                            "version": "6.0.0",
                            "status": "affected",
                            "lessThan": "6.3.6",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "description": "CWE-319: Cleartext Transmission of Sensitive Information",
                            "cweId": "CWE-319",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/61"
                },
                {
                    "url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6"
                }
            ],
            "metrics": [
                {
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ],
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                        "attackVector": "NETWORK",
                        "attackComplexity": "HIGH",
                        "privilegesRequired": "NONE",
                        "userInteraction": "NONE",
                        "scope": "UNCHANGED",
                        "confidentialityImpact": "HIGH",
                        "integrityImpact": "HIGH",
                        "availabilityImpact": "NONE",
                        "baseScore": 7.4,
                        "baseSeverity": "HIGH"
                    }
                }
            ],
            "solutions": [
                {
                    "lang": "en",
                    "value": "Upgrade to hMailServer 6.3.6, which verifies DANE-TA as well as DANE-EE records and requires TLS to a host whose validated TLSA records are all unusable. Until then, an SMTP route for each recipient domain concerned that names its mail exchangers with the connection security 'STARTTLS (required)' prevents delivery in cleartext to that domain."
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "Found in the hMailServer project's own security review (Progressive Robot Ltd)",
                    "type": "finder"
                }
            ],
            "providerMetadata": {
                "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
                "shortName": "GitLab",
                "dateUpdated": "2026-10-08T10:52:40.630Z"
            }
        }
    }
}