{"id":"CVE-2026-114472","kind":"vulnerability","aliases":["CVE-2026-114472"],"related":[],"title":"hMailServer: idle connections can stall TLS certificate renewal over ACME","description":"Insufficient resource pool in the ACME HTTP-01 challenge responder of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to cause a certificate issuance or renewal to fail. When the server obtains or renews a TLS certificate over ACME it runs an HTTP-01 challenge responder on port 80 for the certificate authority to read the challenge token; the responder served one connection at a time, accepting a socket, waiting up to five seconds to receive a request, answering it, and only then accepting the next. A client that connected and sent nothing held the single worker for the whole timeout, so enough idle connections during a validation keep the certificate authority's own request from being answered in time and the validation fails. Sustained across a certificate's renewals this leads to the certificate expiring, after which clients refuse the server's TLS; the mail service itself continues on its current certificate until then. No authentication is required to connect to the responder. Version 6.3.7 serves up to 64 connections at once and closes a connection past that, so that where a handful of idle connections, one after another, sufficed before, a client must keep 64 idle connections open at once throughout a validation to have the certificate authority's connection closed.","summary":"The ACME HTTP-01 challenge responder in hMailServer 6.0.0 through 6.3.6 handles one connection at a time and waits up to five seconds on silent clients. An unauthenticated remote attacker can hold that single worker with idle connections so the certificate authority's validation fails, and the certificate eventually expires.","severity":"low","cvss":3.7,"epss":0.00208,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["acme","hmailserver","package","self-hosted","tls"],"not_affected_if":["default-config","manual-certificates"],"how_to_check":"- Check the installed hMailServer version; versions `6.0.0` through `6.3.6` are in scope.\n- Confirm whether the server uses ACME (automatic TLS certificate issuance or renewal) on port 80.","fix":"- Upgrade hMailServer to `6.3.7` or later, which serves up to 64 connections at once.","status":"open","published_at":"2026-10-21T16:17:34+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:43:31+00:00","updated_at":"2026-10-25T04:43:31+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:43:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade hMailServer to `6.3.7` or later, which serves up to 64 connections at once.","reach":"internet","title":"hMailServer: idle connections can stall TLS certificate renewal over ACME","impact":"low","summary":"The ACME HTTP-01 challenge responder in hMailServer 6.0.0 through 6.3.6 handles one connection at a time and waits up to five seconds on silent clients. An unauthenticated remote attacker can hold that single worker with idle connections so the certificate authority's validation fails, and the certificate eventually expires.","category":"package","nicknames":[],"who_cares":["hmailserver","self-hosted","tls","acme"],"confidence":0.7,"needs_auth":"no","worst_case":"certificate renewal fails and the TLS certificate eventually expires","analyst_note":"","how_to_check":"- Check the installed hMailServer version; versions `6.0.0` through `6.3.6` are in scope.\n- Confirm whether the server uses ACME (automatic TLS certificate issuance or renewal) on port 80.","needs_analyst":false,"not_affected_if":["default-config","manual-certificates"],"who_is_affected":"Servers running hMailServer 6.0.0 through 6.3.6 that obtain or renew TLS certificates over ACME with the HTTP-01 challenge, which requires port 80 to be reachable from the internet. Servers using certificates from another source, or ACME via DNS-01, are not exposed through this responder.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000643,"input_tokens":3670,"output_tokens":551,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-01':27B,81C,120C '-114472':13A,16A '-2026':12A,15A '6.0.0':32B,88C '6.3.6':34B,90C '6.3.7':242C '64':246C,273C '80':125C 'accept':143C,160C 'acm':10A,17B,25B,79C,115C 'across':202C 'allow':91C 'anoth':266C 'answer':155C,194C 'attack':53B,95C 'authent':233C 'author':65B,129C,188C,286C 'caus':97C 'certif':7A,64B,71B,99C,113C,128C,187C,204C,211C,229C,285C 'challeng':28B,82C,121C,133C 'client':49B,164C,215C,270C 'close':251C,289C 'connect':3A,37B,61B,139C,166C,181C,237C,247C,253C,263C,275C,288C 'continu':225C 'current':228C 'cve':11A,14A 'enough':179C 'eventu':72B 'expir':73B,212C 'fail':68B,104C,200C 'five':45B,149C 'hand':260C 'handl':35B 'held':170C 'hmailserv':1A,18B,31B,87C 'hold':55B 'host':22B 'http':26B,80C,119C 'idl':2A,60B,180C,262C,274C 'insuffici':74C 'issuanc':100C 'keep':185C,272C 'lead':208C 'mail':222C 'must':271C 'next':162C 'noth':169C 'obtain':108C 'one':36B,138C,264C 'open':276C 'packag':19B 'past':254C 'pool':76C 'port':124C 'progress':85C 'read':131C 'receiv':152C 'refus':216C 'remot':52B,93C 'renew':8A,102C,110C,206C 'request':154C,191C 'requir':235C 'resourc':75C 'respond':29B,83C,122C,136C,240C 'robot':86C 'run':117C 'second':46B,150C 'self':21B 'self-host':20B 'sent':168C 'serv':137C,243C 'server':107C,218C 'servic':223C 'silent':48B 'singl':57B,172C 'socket':145C 'stall':5A 'suffic':267C 'sustain':201C 'throughout':279C 'time':40B,142C,196C 'timeout':177C 'tls':6A,23B,112C,220C 'token':134C 'unauthent':51B,94C 'valid':67B,184C,199C,281C 'version':241C 'wait':42B,146C 'whole':176C 'worker':58B,173C","nicknames":[],"mitigations":[],"who_affected":"Servers running hMailServer 6.0.0 through 6.3.6 that obtain or renew TLS certificates over ACME with the HTTP-01 challenge, which requires port 80 to be reachable from the internet. Servers using certificates from another source, or ACME via DNS-01, are not exposed through this responder.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T16:17:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114472","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114472","severity":null,"published_at":"2026-10-21T16:17:34+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114472","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114472","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}