Signals
Back to database
Soon74High7.4VulnerabilityCVE-2026-104704No patch link observed

CVE-2026-104704 — Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA r…

Published Oct 8, 2026, 11:16 AM UTCIngested 13h agoSource NVD(cve-db)CVE-2026-104704

Description

Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record set consisting of DANE-TA (usage 2) or otherwise unusable records as if no records were published, so delivery to such a host fell back to opportunistic TLS. An attacker with an active position on the network path between the server and the recipient's mail exchanger can suppress or break the STARTTLS negotiation and cause messages to be delivered in cleartext, where they can be read and modified.

CVSS v3.1 base metrics

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
7.4

High severity

Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.

AV

Network

Attack Vector

AC

High

Attack Complexity

PR

None

Privileges Required

UI

None

User Interaction

S

Unchanged

Scope

C

High

Confidentiality

I

High

Integrity

A

None

Availability

References

Related threats

same CWE or vendor
Medium

CVE-2026-107714 — The Mechanize library is used for automating interaction with websites.

CVE-2026-107714 · 3h ago

Medium

CVE-2026-107285 — The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVE-2026-107285 · 1d ago

Critical

CVE-2026-107282 — The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVE-2026-107282 · 1d ago

High

CVE-2026-107232 — The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVE-2026-107232 · 1d ago

High

CVE-2026-107231 — The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVE-2026-107231 · 1d ago

High

CVE-2026-92543 — Docker Engine classifies a registry hostname as insecure using an any-match DNS check.

CVE-2026-92543 · 1d ago