{"id":"CVE-2026-126609","kind":"vulnerability","aliases":["CVE-2026-126609"],"related":[],"title":"hMailServer: certificate file name lookup on Windows lets attackers spoof trust","description":"Progressive Robot hMailServer 6.2.25 through 6.3.7 on Windows, with a PostgreSQL database, the connection's sslmode require, verify-ca or verify-full, and a root certificate file named by PostgreSQLSslRootCert (from 6.2.25) or, with TlsMode=verify-full and neither PostgreSQL key set, by TlsCaFile (from 6.3.4), hands the file's name to libpq as bytes in the system's ANSI code page (up to 6.3.5 as Latin-1 bytes, which on code page 1252 are the code page's own for U+00A0 to U+00FF), and libpq looks for the file by those bytes and then hands the same bytes to OpenSSL, whose file opening on Windows reads a name as UTF-8 first and opens the file at that reading when one is there. When every byte of the name outside ASCII also reads as UTF-8 - for example U+00C3 U+00A9, the bytes C3 A9 on code page 1252, which are U+00E9 in UTF-8 - the database server's certificate was checked against the file at that other name whenever one was there, which allows a local attacker who can create that file but cannot change the configured one, as any user can by default beside a file an administrator keeps under ProgramData, or beside a folder directly under the system drive's root whose permissions the administrator restricted, and who can intercept the connection to the database server or stand in for it, to have hMailServer trust a certificate authority of the attacker's own and read and modify the traffic between hMailServer and its database, the database password included; the file alone, holding no authority that issued the database server's certificate, stops hMailServer from connecting to its database. The same applies in 6.3.4 through 6.3.7 to TlsCaFile when an Oracle MySQL client library has been put in place of the bundled MariaDB Connector/C, since that client opens the file through OpenSSL in the same way; the bundled MariaDB Connector/C opens the file in the code page and is not affected, and neither are the Linux builds. The configuration is not the default: by default no root certificate file is named.","summary":"hMailServer on Windows, when connecting to PostgreSQL with certificate verification and a named root certificate file, can be made to trust an attacker's certificate authority because the file name is interpreted in two different encodings. A local attacker who can create a file at the alternate name and who can intercept or stand in for the database connection can read and modify traffic to the database, including the database password.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"hMailServer","fixed":["6.3.8"],"affected":">= 6.2.25, <= 6.3.7 (Windows)","ecosystem":"vendor"}],"ecosystems":[],"tags":["hmailserver","package","postgresql","self-hosted","tls","windows"],"not_affected_if":["ascii-file-name","bundled-mariadb-connector","default-config","linux","no-root-cert-file"],"how_to_check":"- Windows only. Check the installed hMailServer version: 6.2.25 through 6.3.7 is affected; 6.3.8 is the fix. Linux builds are not affected.\n- In hMailServer.ini [Database], check for PostgreSQLSslRootCert, or TlsMode=verify-full with TlsCaFile and neither PostgreSQL key set (6.3.4+). Also check the sslmode: require, verify-ca or verify-full (from PostgreSQLSslMode, TlsMode, or PGSSLMODE in the service environment).\n- Exposed only if the file name has non-ASCII characters whose code-page bytes also read as valid UTF-8 (for example é written as the bytes C3 A9 on code page 1252). An ASCII-only path is not exposed.\n- Also check if you run MySQL/MariaDB (6.3.4 to 6.3.7) with an Oracle libmysql.dll in place of the bundled MariaDB Connector/C and a TlsCaFile name of that kind. The bundled Connector/C is not affected.","fix":"Upgrade to hMailServer 6.3.8 (released 2 November 2026). It refuses, with error HM7534, a TlsCaFile or PostgreSQLSslRootCert whose name the client cannot be handed as written, so give the file and its folders ASCII-only names before upgrading. Workaround until then: use an ASCII-only path for the root certificate file.","status":"open","published_at":"2026-11-11T09:17:12+00:00","first_seen_at":"2026-11-11T09:26:47+00:00","triaged_at":"2026-11-11T09:28:30+00:00","updated_at":"2026-11-11T09:31:11+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-11T09:28:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"hMailServer: certificate file name lookup on Windows lets attackers spoof trust","impact":"high","summary":"hMailServer on Windows, when connecting to PostgreSQL with certificate verification and a named root certificate file, can be made to trust an attacker's certificate authority because the file name is interpreted in two different encodings. A local attacker who can create a file at the alternate name and who can intercept or stand in for the database connection can read and modify traffic to the database, including the database password.","audience":"businesses","category":"package","nicknames":[],"who_cares":["hmailserver","windows","postgresql"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads and modifies database traffic, including the database password","analyst_note":"Fixed version not stated in the sources; check the hMailServer release notes or the NVD entry for the patched release.","how_to_check":"- Check the hMailServer version in the installed program files: 6.2.25 through 6.3.7 are affected.\n- Check whether the configuration sets `PostgreSQLSslRootCert` or `TlsCaFile`, with `sslmode` set to `require`, `verify-ca` or `verify-full`.\n- Check whether a MySQL client library replaced the bundled MariaDB Connector/C (affects 6.3.4 through 6.3.7 with `TlsCaFile`).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","linux","no-root-cert-file"],"who_is_affected":"Windows hMailServer installations connected to a PostgreSQL database with certificate verification and a configured root certificate file are exposed. Linux builds and the default configuration, which names no root certificate file, are not affected. The attack needs a local user who can create files next to the configured certificate file.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000848,"input_tokens":5155,"output_tokens":665,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed version not stated in the sources; check the hMailServer release notes or the NVD entry for the patched release.","search":"'+00':183C,187C,245C,248C '+00e9':261C '-1':168C '-126609':14A,17A '-2026':13A,16A '-8':216C,241C,264C '1252':174C,257C '6.2.25':101C,131C '6.3.4':146C,395C '6.3.5':165C '6.3.7':103C,397C 'a0':184C 'a9':249C,253C 'administr':309C,327C 'affect':442C 'allow':284C 'alon':373C 'also':237C 'altern':73B 'ansi':160C 'appli':393C 'ascii':236C 'attack':9A,49B,65B,287C,353C 'author':52B,350C,376C 'besid':305C,314C 'build':448C 'bundl':413C,429C 'byte':155C,169C,197C,203C,231C,251C 'c3':246C,252C 'ca':117C 'cannot':294C 'certif':2A,35B,41B,51B,125C,269C,349C,383C,459C 'chang':295C 'check':271C 'client':404C,418C 'code':161C,172C,177C,255C,437C 'configur':297C,450C 'connect':31B,85B,111C,334C,387C 'connector/c':415C,431C 'creat':68B,290C 'cve':12A,15A 'databas':84B,93B,96B,109C,266C,337C,366C,368C,380C,390C 'default':304C,454C,456C 'differ':61B 'direct':317C 'drive':321C 'encod':62B 'everi':230C 'exampl':243C 'ff':188C 'file':3A,42B,55B,70B,126C,149C,194C,207C,221C,274C,292C,307C,372C,421C,434C,460C 'first':217C 'folder':316C 'full':121C,137C 'hand':147C,200C 'hmailserv':1A,19B,27B,100C,346C,363C,385C 'hmailserver':18A 'hold':374C 'host':24B 'includ':94B,370C 'intercept':78B,332C 'interpret':58B 'issu':378C 'keep':310C 'key':141C 'latin':167C 'let':8A 'libpq':153C,190C 'librari':405C 'linux':447C 'local':64B,286C 'look':191C 'lookup':5A 'made':45B 'mariadb':414C,430C 'modifi':89B,359C 'mysql':403C 'name':4A,39B,56B,74B,127C,151C,213C,234C,278C,462C 'neither':139C,444C 'one':226C,280C,298C 'open':208C,219C,419C,432C 'openssl':205C,423C 'oracl':402C 'outsid':235C 'packag':20B 'page':162C,173C,178C,256C,438C 'password':97B,369C 'permiss':325C 'place':410C 'postgresql':21B,33B,108C,140C 'postgresqlsslrootcert':129C 'programdata':312C 'progress':98C 'put':408C 'read':87B,211C,224C,238C,357C 'requir':114C 'restrict':328C 'robot':99C 'root':40B,124C,323C,458C 'self':23B 'self-host':22B 'server':267C,338C,381C 'set':142C 'sinc':416C 'spoof':10A 'sslmode':113C 'stand':80B,340C 'stop':384C 'system':158C,320C 'tls':25B 'tlscafil':144C,399C 'tlsmode':134C 'traffic':90B,361C 'trust':11A,47B,347C 'two':60B 'u':182C,186C,244C,247C,260C 'user':301C 'utf':215C,240C,263C 'verif':36B 'verifi':116C,120C,136C 'verify-ca':115C 'verify-ful':119C,135C 'way':427C 'whenev':279C 'whose':206C,324C 'window':7A,26B,29B,105C,210C","nicknames":[],"mitigations":[],"who_affected":"Windows hMailServer 6.2.25 through 6.3.7 that uses PostgreSQL with a root certificate file named by PostgreSQLSslRootCert or TlsCaFile, and a non-ASCII file name. A local user who can create a file at the alternate name, and who can also intercept or impersonate the database server, can have the server trust their CA and read or change database traffic, including the password. Without the network position, the planted file only stops the database connection. Linux builds, SQL Server, the bundled MariaDB Connector/C and the default config (no root cert file named) are not affected.","tier":"B","verified":{"fix":{"at":"2026-11-11T09:31:11Z","by":"analyst","doc":"https://www.progressiverobot.com/hmailserver/Hmail-server/6.3.8/readme.txt","run_id":3531},"products":{"at":"2026-11-11T09:31:11Z","by":"analyst","doc":"https://www.progressiverobot.com/hmailserver/Hmail-server/6.3.8/readme.txt","run_id":3531},"how_to_check":{"at":"2026-11-11T09:31:11Z","by":"analyst","doc":"https://www.progressiverobot.com/hmailserver/Hmail-server/6.3.8/readme.txt","run_id":3531},"who_affected":{"at":"2026-11-11T09:31:11Z","by":"analyst","doc":"https://www.progressiverobot.com/hmailserver/Hmail-server/6.3.8/readme.txt","run_id":3531}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["hmailserver"],"ptokens":["hmailserver"],"labels":["high","hmailserver","package","postgresql","selfhosted","tls","windows"],"campaign_type":null,"search_a":"'-126609':14A,17A '-2026':13A,16A 'attack':9A 'certif':2A 'cve':12A,15A 'file':3A 'hmailserv':1A 'hmailserver':18A 'let':8A 'lookup':5A 'name':4A 'spoof':10A 'trust':11A 'window':7A","search_b":"'altern':73B 'attack':49B,65B 'author':52B 'certif':35B,41B,51B 'connect':31B,85B 'creat':68B 'databas':84B,93B,96B 'differ':61B 'encod':62B 'file':42B,55B,70B 'hmailserv':19B,27B 'host':24B 'includ':94B 'intercept':78B 'interpret':58B 'local':64B 'made':45B 'modifi':89B 'name':39B,56B,74B 'packag':20B 'password':97B 'postgresql':21B,33B 'read':87B 'root':40B 'self':23B 'self-host':22B 'stand':80B 'tls':25B 'traffic':90B 'trust':47B 'two':60B 'verif':36B 'window':26B,29B","search_c":"'+00':183C,187C,245C,248C '+00e9':261C '-1':168C '-8':216C,241C,264C '1252':174C,257C '6.2.25':101C,131C '6.3.4':146C,395C '6.3.5':165C '6.3.7':103C,397C 'a0':184C 'a9':249C,253C 'administr':309C,327C 'affect':442C 'allow':284C 'alon':373C 'also':237C 'ansi':160C 'appli':393C 'ascii':236C 'attack':287C,353C 'author':350C,376C 'besid':305C,314C 'build':448C 'bundl':413C,429C 'byte':155C,169C,197C,203C,231C,251C 'c3':246C,252C 'ca':117C 'cannot':294C 'certif':125C,269C,349C,383C,459C 'chang':295C 'check':271C 'client':404C,418C 'code':161C,172C,177C,255C,437C 'configur':297C,450C 'connect':111C,334C,387C 'connector/c':415C,431C 'creat':290C 'databas':109C,266C,337C,366C,368C,380C,390C 'default':304C,454C,456C 'direct':317C 'drive':321C 'everi':230C 'exampl':243C 'ff':188C 'file':126C,149C,194C,207C,221C,274C,292C,307C,372C,421C,434C,460C 'first':217C 'folder':316C 'full':121C,137C 'hand':147C,200C 'hmailserv':100C,346C,363C,385C 'hold':374C 'includ':370C 'intercept':332C 'issu':378C 'keep':310C 'key':141C 'latin':167C 'libpq':153C,190C 'librari':405C 'linux':447C 'local':286C 'look':191C 'mariadb':414C,430C 'modifi':359C 'mysql':403C 'name':127C,151C,213C,234C,278C,462C 'neither':139C,444C 'one':226C,280C,298C 'open':208C,219C,419C,432C 'openssl':205C,423C 'oracl':402C 'outsid':235C 'page':162C,173C,178C,256C,438C 'password':369C 'permiss':325C 'place':410C 'postgresql':108C,140C 'postgresqlsslrootcert':129C 'programdata':312C 'progress':98C 'put':408C 'read':211C,224C,238C,357C 'requir':114C 'restrict':328C 'robot':99C 'root':124C,323C,458C 'server':267C,338C,381C 'set':142C 'sinc':416C 'sslmode':113C 'stand':340C 'stop':384C 'system':158C,320C 'tlscafil':144C,399C 'tlsmode':134C 'traffic':361C 'trust':347C 'u':182C,186C,244C,247C,260C 'user':301C 'utf':215C,240C,263C 'verifi':116C,120C,136C 'verify-ca':115C 'verify-ful':119C,135C 'way':427C 'whenev':279C 'whose':206C,324C 'window':105C,210C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T09:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126609","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126609","severity":null,"published_at":"2026-11-11T09:17:12+00:00","modified_at":"2026-11-11T09:17:12+00:00","first_seen_at":"2026-11-11T09:26:47+00:00","fetched_at":"2026-11-11T09:26:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126609:3531","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/114","severity":null,"published_at":"2026-11-11T09:31:11+00:00","modified_at":"2026-11-11T09:31:11+00:00","first_seen_at":"2026-11-11T09:31:11+00:00","fetched_at":"2026-11-11T09:31:11+00:00","note":"Primary: hMailServer work item 114 (confidential-until-release text, via NVD ref) and 6.3.8 release notes. Fix 6.3.8. No exploitation or PoC found; not searched on social, low-profile. Mitigation: ASCII path (derived from advisory).","cites":["https://gitlab.com/hmailserver/hmailserver/-/work_items/114","https://www.progressiverobot.com/hmailserver/Hmail-server/6.3.8/readme.txt"]}],"documents":[{"id":124363,"url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/114","title":"hMailServer work item 114: database TLS root certificate name read two ways on Windows","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":124361,"url":"https://www.progressiverobot.com/hmailserver/Hmail-server/6.3.8/readme.txt","title":"hMailServer 6.3.8 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}