CVE-2026-114479

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-114479
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114479.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-114479
Published
2026-10-21T15:12:50Z
Modified
2026-10-22T02:48:06Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
Summary
Not Failing Securely ('Failing Open') in hMailServer
Details

Not failing securely in the anti-virus attachment-stripping action of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have a message that the server's virus scanner found infected delivered to the recipient's mailbox unchanged. With virus scanning enabled and its action set to remove attachments and deliver the text (the default action deletes the message), the server keeps one text part of an infected message and replaces every attachment with a note. A message whose single part is not text - a program or an archive sent as the whole message, a message carried whole, a file declared an attachment, or an S/MIME message signed as one part, whose content the recipient's mail client opens - had no part the action could pick out, and was delivered as it arrived, with the content the scanner had found and nothing but a line in the application log to show it. Any sender can write such a message.

Database specific 
{
    "cna_assigner":  "GitLab",
    "cwe_ids":  [
        "CWE-636"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114479.json"
}
References

Affected packages

Git / gitlab.com/hmailserver/hmailserver

Affected ranges

Type
GIT
Repo
https://gitlab.com/hmailserver/hmailserver
Events
Introduced
e4b7163189ac6ce365bb954cf3e264e2e3105a18
Last Affected
e3c448aa66fc310b74d076884d54fae951296915
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "6.0.0"
                },
                {
                    "last_affected":  "6.3.6"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

Other
build-inputs-1
v6.*
v6.0.0
v6.0.0-B3
v6.0.0-B4
v6.1.0
v6.2.0
v6.2.1
v6.2.10
v6.2.11
v6.2.12
v6.2.13
v6.2.14
v6.2.15
v6.2.16
v6.2.17
v6.2.18
v6.2.19
v6.2.2
v6.2.20
v6.2.21
v6.2.22-pre1
v6.2.22-pre2
v6.2.22-pre3
v6.2.22-pre4
v6.2.22-pre5
v6.2.22-pre6
v6.2.23-alpha1
v6.2.23-alpha2
v6.2.24
v6.2.25
v6.2.26
v6.2.27
v6.2.28
v6.2.3
v6.2.4
v6.2.5
v6.2.6
v6.2.7
v6.2.8
v6.2.9
v6.3.0
v6.3.1
v6.3.2
v6.3.3
v6.3.4
v6.3.5
v6.3.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114479.json"