CVE-2026-100741
- Source
- https://cve.org/CVERecord?id=CVE-2026-100741
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100741.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-100741
- Published
- 2026-09-27T07:12:54Z
- Modified
- 2026-10-21T09:31:54Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer
- Details
-
Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a password containing a backslash followed by an apostrophe, sent in any logon (SMTP AUTH, POP3, IMAP) that names an existing, active account. Exploitation requires a non-default configuration: event scripting enabled (off by default), the script language set to JScript (the default is VBScript), and an OnClientValidatePassword handler defined in the event script. The server wrote event values into the handler call as JScript string literals, escaping the apostrophe but not the backslash, so such a value closes the literal and the rest of it is parsed as script. The same flaw is reachable by a remote POP3 server through the message UID it returns, where an OnExternalAccountDownload handler is defined, and by a remote SMTP server through the error reply it rejects a delivery with, where an OnDeliveryFailed handler is defined. Before 6.2.25 the injected script can create any COM object, and from 6.2.25 it can with the default ScriptAllowedObjects value of '*'; WScript.Shell among them gives command execution as the service account. VBScript event scripts and the Linux builds of Progressive Robot Ltd's hMailServer are not affected.
- Database specific
{ "cna_assigner": "GitLab", "cwe_ids": [ "CWE-95" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100741.json" }- References
-
- https://gitlab.com/Progressiverobot/hmailserver/-/releases/v6.3.4
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100741.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-100741
- https://gitlab.com/Progressiverobot/hmailserver/-/commit/5a3de9001d6c5e833662ada8e44ce10d42d76b1a
Affected packages
Git / gitlab.com/hmailserver/hmailserver
Affected ranges
- Type
- GIT
- Repo
- https://gitlab.com/hmailserver/hmailserver
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "6.0.0" }, { "fixed": "6.3.4" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "5a3de9001d6c5e833662ada8e44ce10d42d76b1a" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
Other
build-inputs-1
v6.*
v6.0.0
v6.0.0-B3
v6.0.0-B4
v6.1.0
v6.2.0
v6.2.1
v6.2.10
v6.2.11
v6.2.12
v6.2.13
v6.2.14
v6.2.15
v6.2.16
v6.2.17
v6.2.18
v6.2.19
v6.2.2
v6.2.20
v6.2.21
v6.2.22-pre1
v6.2.22-pre2
v6.2.22-pre3
v6.2.22-pre4
v6.2.22-pre5
v6.2.22-pre6
v6.2.23-alpha1
v6.2.23-alpha2
v6.2.24
v6.2.25
v6.2.26
v6.2.27
v6.2.28
v6.2.3
v6.2.4
v6.2.5
v6.2.6
v6.2.7
v6.2.8
v6.2.9
v6.3.0
v6.3.1
v6.3.2
v6.3.3
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100741.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"173026644744428468122178710305458733610",
"72023418976949700636706848348170513083",
"221755301875929245221851728560244100688",
"86015716840889777238664922845986602568"
],
"threshold": 0.9
},
"id": "CVE-2026-100741-03cbf0d8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be",
"target": {
"file": "hmailserver/source/Server/Common/Util/OpenPgpKey.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "221298502580959622673081158792108986591",
"length": 973
},
"id": "CVE-2026-100741-160ac7e9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be",
"target": {
"file": "hmailserver/source/Server/Common/Util/BrandLogo.cpp",
"function": "BrandLogo::Known"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "128923565477708758940593015408547466370",
"length": 2150
},
"id": "CVE-2026-100741-1df6719b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a",
"target": {
"file": "hmailserver/source/Server/Common/Application/ErrorManager.cpp",
"function": "ErrorManager::ReportError_"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "331635609444975975074704696935829754652",
"length": 1652
},
"id": "CVE-2026-100741-1f0946dc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a",
"target": {
"file": "hmailserver/source/Server/Common/Scripting/Events.cpp",
"function": "Events::FireOnExternalAccountDownload"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"144971333099417583677465868090583294341",
"31159591477287234542554676120105802797",
"187316242465413148142487768211424648896"
],
"threshold": 0.9
},
"id": "CVE-2026-100741-25acf673",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be",
"target": {
"file": "hmailserver/source/Server/Common/AntiSpam/DMARC/DMARC.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "186398542115389452270982473998957878288",
"length": 5043
},
"id": "CVE-2026-100741-2ade12be",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be",
"target": {
"file": "hmailserver/source/Server/Common/Util/BrandLogo.cpp",
"function": "BrandLogoTester::Test"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"168436356617409950203061960813192391513",
"6794219631689290374375489382766084136",
"252982190880083623206279529070075974574",
"299040040893001406502522247329002866547",
"287776739933185647292506548609677251186",
"231079773074675756992636741122816628595",
"202456874104008953527166003454093353990",
"280163632586104781557342952693406806439",
"331526745349849731646393559398602458790",
"243494023290129129247647142079354925171",
"136050685234224721948291361893832728254",
"31933306883685020205990209721312268021",
"121118874047973560113727775030293053838",
"150404206715707704019842938531875526158",
"321727766633300175530979160633919537387",
"135856718981026289583584401003473709918",
"134844127943263121532631510593039974225",
"272110326339456724343688205065594121499",
"51853996588338471719564324329830795455",
"79537457975022156230197554773554757390",
"159047340350530216060843677576605554244",
"11054909884212234558068204007937845336",
"138198898639824643694516625013774586703",
"234224701433770972670466770643766770767",
"301397185273431833290693057306824921022",
"172773720504601780971733192650514012601",
"298420838722684324919004038955221678482",
"112713433705879362159734459973400990002",
"58725824035969435507292074060043744404",
"187155979713494877424140503413922900249",
"43562112869163724717121068670467317579",
"186181325023914072765685820336622063621",
"36162853698317664990001524707683579454",
"130160835077689870641305337167501541080",
"172303239323519771248590415933409487693",
"263003904147061727736075762846303040636",
"328623339914416941917653308980437055009",
"93184631329294095492664046036972427577",
"238612367967960963215902181164545442400",
"130542493997154179637231108077803085067",
"56551016899255927073418015047294135406",
"4140569880360836934746170614674767758"
],
"threshold": 0.9
},
"id": "CVE-2026-100741-3bfe3d58",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be",
"target": {
"file": "hmailserver/source/Server/Common/Util/BrandLogo.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "310319588703213628297204907685271355499",
"length": 1570
},
"id": "CVE-2026-100741-48019660",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a",
"target": {
"file": "hmailserver/source/Server/Common/Scripting/Events.cpp",
"function": "Events::FireOnDeliveryFailed"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"54736881936118555589558946657062301954",
"229706180944439301771732116542379163491",
"174414407847498382000071080308127779853",
"229168194170764373883841146782549492150",
"98601569559253649160716883419270915539",
"233779230979790557805985077034284925309",
"82084196348983213666697620292601882068",
"274430235164293542590454059444639719087",
"141705646902593885552709430821529650415"
],
"threshold": 0.9
},
"id": "CVE-2026-100741-50e4df90",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a",
"target": {
"file": "hmailserver/source/Server/Common/Scripting/ScriptServer.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "278807372347695046392379528524658391690",
"length": 1491
},
"id": "CVE-2026-100741-540d43f2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be",
"target": {
"file": "hmailserver/source/Server/Common/AntiSpam/DMARC/DMARC.cpp",
"function": "DMARC::GetOrganizationalDomain"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "188978514926816756569628164524781870217",
"length": 33109
},
"id": "CVE-2026-100741-5aedc00a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a",
"target": {
"file": "hmailserver/source/Server/Common/Util/ClassTester.cpp",
"function": "ClassTester::DoTests"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "281966080051011728174539370975067727778",
"length": 358
},
"id": "CVE-2026-100741-5e92b1d6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a",
"target": {
"file": "hmailserver/source/Server/Common/Application/ErrorManager.cpp",
"function": "ErrorManager::EscapeForScriptLiteral_"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "101049009052070862673143003378209265536",
"length": 2529
},
"id": "CVE-2026-100741-600a17a1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be",
"target": {
"file": "hmailserver/source/Server/Common/Util/BrandLogo.cpp",
"function": "BrandLogo::Lookup"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "201216107189199025747155831459028417972",
"length": 291
},
"id": "CVE-2026-100741-685fb01d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be",
"target": {
"file": "hmailserver/source/Server/Common/Util/OpenPgpRing.cpp",
"function": "OrganizationOf"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "123310048572992211037007553603146831106",
"length": 355
},
"id": "CVE-2026-100741-7ad95dc8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be",
"target": {
"file": "hmailserver/source/Server/Common/Util/BrandLogo.cpp",
"function": "BrandLogo::NoteUnreachable"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"106542373993982903543230604757882353669",
"232196250110594156689439420422749690313",
"183220730686388094287609818594086984991",
"236198940078758749668739929570747975194",
"34624701013936692121560702308961838544"
],
"threshold": 0.9
},
"id": "CVE-2026-100741-7b5a34ed",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a",
"target": {
"file": "hmailserver/source/Server/Common/Application/BackupManager.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"338715573963286343287474767827236227017",
"244823307453781921811613512757342559022",
"84469750297443293998760181763802401571",
"112316489728264184261874751677275701895",
"193336097000849899974040375549043079245",
"16651200450420897554869769241312721239",
"239300529221871919801485047881267520496",
"7878502701028849306991325437848116380",
"49897272061219843746989700225227931975",
"302842601042940520570921422167684580374",
"165907117179942306000762870567200518772",
"149971453418278372951411869274750006094",
"202670703186588759321138870142824935845",
"241973761619791918414143273412179633204",
"128037545091248458351195096774796111916",
"236112913281880244353062392931862450415",
"203885134244102568214106785333954036255",
"205291756924249671200777490872718764520",
"21773715346609150253438994555764090134",
"316039707997507475214784447065013306015",
"189804384264932200349495994266313637401"
],
"threshold": 0.9
},
"id": "CVE-2026-100741-828e5376",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a",
"target": {
"file": "hmailserver/source/Server/Common/Util/HelpPagesData.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"235068009922122245096147898414527796890",
"202106208347999268925592517405875427969",
"212410323386508029321599072476377419926",
"8699687235561483272917986714755626690",
"27572851692492310316005505644064616454",
"30868162295207361792691055685853797228",
"164839102790152075046176846417164749915",
"65724994755792004753800618633318034501",
"192032997600568690392612768127567039470",
"12742992406361118291249721030484681457",
"127838980516391427577527551327428176606",
"323948830972994709904113873473827349745",
"57608324879848345999591147933579544961",
"140393602716224035271326317422783533109",
"110668317227959833320982902346735745874",
"155277232727133947236394653022051299778",
"110959077466463243528577149614472231821",
"172965732375608997302301081235840948294",
"233413406406677967744629536972060661400",
"146047042278794520739498090638610757177",
"162015983949435950377260178721004750611",
"185694148416676895542366415082009488414",
"332077676686110490887743121563340614681",
"172828099241677199888766075062815208211",
"211008518954599491222561611925596679441",
"246681204928392871535838691271371047644",
"237900866802777836041923701971043576038",
"103619381092571575608774015844001031226",
"315837747138612504222060109135406842711",
"337020304475620992958740594743328339692",
"264917997795488587494918981771097390718",
"35313025998849292817538963929079217330",
"211008518954599491222561611925596679441",
"246681204928392871535838691271371047644",
"297719828275464945153406459408754272800",
"174973971600193173322461794377329552806"
],
"threshold": 0.9
},
"id": "CVE-2026-100741-870e6e3c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a",
"target": {
"file": "hmailserver/source/Server/Common/Application/ErrorManager.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"235758542281879581439071837042782900296",
"39854109563317671887276956300757111729",
"180591959127919996928156142301543362502",
"267111967522577991641479310576499398938",
"69453275827299831512192435788517335221",
"21043194468232056726023629652902425387",
"336693078245008672052710251389787425132"
],
"threshold": 0.9
},
"id": "CVE-2026-100741-88219093",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a",
"target": {
"file": "hmailserver/source/Server/Common/Util/ClassTester.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"205876520467730485614981509545869293398",
"21764508780791362081414858423125947900",
"65647469226180869829424521064035847269",
"238239859876124510733713041366881415818",
"306728571835279173710560041571424985290"
],
"threshold": 0.9
},
"id": "CVE-2026-100741-8bdace81",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a",
"target": {
"file": "hmailserver/source/Server/Common/Scripting/ScriptServer.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "222910894375453233701528945680416242832",
"length": 1121
},
"id": "CVE-2026-100741-ac1386ce",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a",
"target": {
"file": "hmailserver/source/Server/Common/Application/BackupManager.cpp",
"function": "BackupManager::OnBackupFailed"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"217382572294579024735186115350336824679",
"232644099280258314673252833632276642099",
"110569033486641569700537356008436665845",
"84119630109514399254486181244345713130",
"259019608430282499671422980499421477618",
"52087883268710942835635511936791275282",
"179030710271600826080624829516933781491",
"224199370542123069802823027860631327891",
"200353981174873361365807128097563402385",
"316390505624589695144811903274316766118",
"133089887383778879198519001979618554720",
"54950605529578730242318991905163910731",
"265855952655961837495456519263390755392",
"230353888280009246803103428288728273728",
"76779441353424855381469476030476787557",
"79012237758407394652907649643996776792",
"25522713397161463026179222506230686611",
"64126595560494705544673621272880779613",
"211058975816949608175577181041279670458",
"29800085896162780145646767332964607418",
"301730279402659834591514492834334066072",
"186630290065603701434527332358208467213",
"25638580773822852539937310495465095447",
"259915868232482277532496485102897914632",
"82250017844024707338911690750149863928",
"174084133835922313078379776494829066329",
"2065155735359526455960829967888112969",
"160514846154226678461703270474070596984",
"43989780037341512358409362985998826467",
"284473009188797321148608657203341343862",
"118098243344204889721369539689993235560",
"283309733487295571326145247622519034222",
"331614447821169766920274085995693130986",
"176657794663911736929009410982039958967",
"223379499072880358704029102742648425174",
"336558161408354835180887745069676588330",
"176679858706659811817064273985023338676",
"60358499010207033038067530593022014384",
"274151641384423890508517136232117386476"
],
"threshold": 0.9
},
"id": "CVE-2026-100741-b3897b18",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be",
"target": {
"file": "hmailserver/source/Server/Common/Util/HelpPagesData.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "203823155983048518933070330295708678424",
"length": 393
},
"id": "CVE-2026-100741-b73bf924",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be",
"target": {
"file": "hmailserver/source/Server/Common/Util/BrandLogo.cpp",
"function": "BrandLogo::OrganizationUnreachable"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"13305429830417078381577849579222307952",
"200963078023762552825019393750614922818",
"253563660183400374534982320389126141836",
"234216325056108639265321213186242383847",
"323502006306225203958453684764698789172",
"330608554865418440534524197738713451695"
],
"threshold": 0.9
},
"id": "CVE-2026-100741-b83b53f7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be",
"target": {
"file": "hmailserver/source/Server/Common/Util/OpenPgpRing.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"152299132225481955129083943650846430355",
"6832375023684051416024853616361073248",
"17286084956157793008968093056903433243",
"333926647583753214205894131391698095821",
"182954244113595280749716391894917881052",
"10858688535906719378376534038702630206",
"49245178924821749663418407928741492277",
"198449475183301911312041086383448532849",
"245747971491445848035082446334526738410",
"278093215453296294471553309692391210011",
"22720539698454247105318459248710942846",
"260309424996080693003755716393366232174",
"297613183086039466654188872362741305411",
"83957724610820370361630691803768850830",
"26495453224653257279366685044481481565",
"189709503675348466167373995380834859094",
"10978199679427179090966753870859204368",
"9154682085417310374767006515767487313",
"19881229781620602186308276457337437711",
"324572266610113110387869397512302309116",
"109922435036688171536546886352730029414",
"333601900956653395105293064694531168428",
"238793520418025444556797171875566900645",
"16155061912276528935849030281324998088",
"177320160773423319251042524889336844238",
"73058796500149874001442693826784133305",
"27018090392347864312123848083753264713",
"201927254980614350098587277271123287661",
"303686298033920729976632668539186359104",
"156433723844260406884997666237948756309",
"138894064220673407651725242671189798819",
"125019865211290587116655878065852377973",
"230824176478718862520099157531290681061",
"38686542358223295083678148303309426063",
"270472538301331821370673936795850477138",
"49836890341310462912134001365840850705",
"63479588901760399606865205982032770922",
"163341128980479675061617121035740813469",
"340167185421461139211499616584089667658",
"28548489704343060949689971804232349899",
"5395620120301560644686979954111996102",
"280224792796370955696431520193322369242",
"216115057690403493105938423696936861935",
"293786890815987531955079945967820543629",
"320761796262881018007117505877699757993",
"5857276131175026203138028776326389310",
"135767860110261933709455295171715619804"
],
"threshold": 0.9
},
"id": "CVE-2026-100741-be0bf4aa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be",
"target": {
"file": "hmailserver/source/Server/Common/Util/OpenPgpRing.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "69966790253968744245818810918552131457",
"length": 3970
},
"id": "CVE-2026-100741-bf4ce9dc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a",
"target": {
"file": "hmailserver/source/Server/Common/Scripting/ScriptServer.cpp",
"function": "ScriptServer::FireEvent"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"185457136636630786016387300638476587444",
"313508833223557017696788960207980164864",
"1107235692602077839319995840458238301",
"39660285421076289600162885773794208520",
"187594608586215307500194312235013694228",
"18430386238688280566208019113092141915",
"72069862785867228852786701870890024257",
"201909523222810530427390132110981369246",
"178174268358184673851036887732558749305",
"104214642376183267096625871118126691762",
"302605622537871218917150777753203180212",
"2183771615646285003987018217378575415",
"196675853901054916109552851174915360877",
"247151911840617762179170503584148311024",
"263259147706285659474129660642266862551",
"27584707124496793590657781751139464102",
"125498288205216845856168511069480281207",
"207707212446618272237586881059258871317",
"117835249732406250691455072818160233531",
"58837913699016000374947067995238259615",
"242803848709297649809821469941606096200",
"232186321677285315433934956339205199426"
],
"threshold": 0.9
},
"id": "CVE-2026-100741-c1ef3237",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a",
"target": {
"file": "hmailserver/source/Server/Common/Scripting/Events.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "16789147279579673751328946408595684874",
"length": 12845
},
"id": "CVE-2026-100741-d8c252b2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be",
"target": {
"file": "hmailserver/source/Server/Common/Util/OpenPgpKey.cpp",
"function": "OpenPgpKeyTester::Test"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"149908044363547641126729805970713464697",
"134579754139239445225456843238923825694",
"55952527745130178710956086528791140696",
"119590332145380478806719950532080953389",
"24012987281392793160008181792258729292",
"238841215959507221196200319264240349921"
],
"threshold": 0.9
},
"id": "CVE-2026-100741-dbadab72",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be",
"target": {
"file": "hmailserver/source/Server/Common/AntiSpam/DMARC/DMARC.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "240001852906492362512370745183547561127",
"length": 1447
},
"id": "CVE-2026-100741-e01dd8d8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a",
"target": {
"file": "hmailserver/source/Server/Common/Scripting/Events.cpp",
"function": "Events::FireOnClientValidatePassword"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "292573371798982288366075326854979257954",
"length": 3573
},
"id": "CVE-2026-100741-e15fb309",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be",
"target": {
"file": "hmailserver/source/Server/Common/Util/OpenPgpRing.cpp",
"function": "OpenPgpRing::Lookup"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"147925165034629179924120015998028166322",
"273781196487154512984138194203017809776",
"162461377725920649803291145149787481155",
"88581702074200857922836946702888135198"
],
"threshold": 0.9
},
"id": "CVE-2026-100741-ecc57d41",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a",
"target": {
"file": "hmailserver/source/Server/Common/Application/ErrorManager.h"
}
}
]
vanir_signatures_modified
"2026-10-21T09:31:54Z"