hMailServer vulnerabilities and CVEs
Known vulnerabilities affecting hMailServer, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.
18 vulnerabilities tracked.
- 8.8 SQL injection in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.2.18, when the server uses MySQL/MariaDB or…
- 7.8 Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to…
- 7.8 Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows, with a MySQL or MariaDB database, hands the bundled MariaDB Connector/C the…
- 7.5 Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 on Windows hands OpenSSL the names of its own TLS files - the listeners' certificates,…
- 7.5 Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer 6.3.6 and 6.3.7 allows a remote attacker to hold the…
- 7.5 Allocation of resources without limits in the JSON reader of Progressive Robot hMailServer 6.3.2 through 6.3.7 allows a remote attacker to…
- 7.5 Progressive Robot hMailServer 6.2.25 through 6.3.7 on Windows, with a PostgreSQL database, the connection's sslmode require, verify-ca or…
- 7.4 Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database and TlsMode=verify-full, does not hand the database…
- 7.3 Unverified ownership in the Windows installer of Progressive Robot hMailServer 6.3.7 allows a local authenticated user to run code as the…
- 7.3 Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code…
- 7.0 Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database, TlsMode=verify-full and no TlsCaFile, does not verify…
- 6.7 Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code…
- 5.3 The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 counts every failed CardDAV, CalDAV or Autodiscover sign-in…
- 5.3 The auto-ban of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 can be kept from banning an address after repeated failed logons,…
- 5.3 The auto-ban of Progressive Robot hMailServer 6.2.0 through 6.3.3, with a MySQL or MariaDB database, can be kept from banning an address…
- 5.3 The sign-in of Progressive Robot hMailServer 6.2.22-pre2 through 6.3.7 takes for an account names that are not its address but under which…
- 5.3 The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 does not apply the server's IP ranges to the connections it…
- 4.8 Misinterpretation of SQL statement text in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 allows a remote…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that hMailServer is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other products tracked here
Linux Windows Server 2025 Windows Server 2025 (Server Core installation) Windows 11 version 26H1 Windows 11 Version 24H2 Windows 11 Version 25H2 Windows Server 2022 Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 21H2 Windows 10 Version 22H2 Windows 10 Version 1809 Windows 11 Version 23H2 Windows Server 2016 (Server Core installation) Windows Server 2016 Windows 10 Version 1607 Windows 11 Version 26H2 Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Windows Server 2012 R2 Windows Server 2012 R2 (Server Core installation) Windows Server 2012 (Server Core installation) Windows Server 2012 Red Hat Enterprise Linux 10