{"id":"CVE-2026-126610","kind":"vulnerability","aliases":["CVE-2026-126610"],"related":[],"title":"hMailServer: non-ASCII CA file name disables database certificate checks","description":"Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database and TlsMode=verify-full, does not hand the database client the CA file that TlsCaFile names when the file's name contains a character outside ASCII on Linux, or above U+00FF on Windows, which allows an attacker who can intercept the connection to the database server to read and modify the traffic between hMailServer and its database, by presenting, with MariaDB Connector/C 3.4.2 to 3.4.10 as the client, a certificate from any authority, its own included, for any name, and otherwise a certificate for the database server's name issued by any certificate authority in the system's trust store. The server converted the name for the client with the C runtime's conversion in the C locale, which gives an empty string for such a name, and then set no CA file at all, without an error, while certificate verification stayed on, so the client - MariaDB Connector/C, bundled on Windows and the distribution's on Linux - verified the certificate of a database server over the network against the system's trust store instead of the configured CA; Connector/C 3.4.2 to 3.4.10 (bundled on Windows in 6.3.4 to 6.3.6) went further and, with no CA file, took a certificate within its dates whose issuer it could not find, for any name, with neither its chain nor its name checked and no password proof, when the server offered first a sign-in method that hashes the password, which an attacker in the middle chooses (MariaDB's CONC-853, fixed in Connector/C 3.4.11), and Connector/C 3.4 accepted from a MariaDB 11.4 or later server a certificate the store did not vouch for when that server proved it held the account's password; on a connection it treats as local (127.0.0.1, ::1, a Unix socket, a named pipe, and localhost on Windows), Connector/C 3.4.1 and later checked neither the certificate's issuer nor its name, so that a local attacker able to stand in for the database server could present any certificate within its dates of its own making. The settings line of hmailserver --check-database still named the configured file, and the application log said the certificate had been checked. With MariaDB Connector/C 3.4.1 to 3.4.9 as the client - bundled on Windows in 6.3.4 to 6.3.6, and the client of Linux distributions that have not patched it - the missing CA file also met the precondition of CVE-2026-107819, so that a certificate issued for any other name by a trusted authority was enough to obtain the database password. On Linux the file was found only when the server ran on glibc under a locale whose character set holds the name's characters (a UTF-8 locale, or a legacy 8-bit one the system has, in whose bytes the file is then named); with no locale, LC_ALL=C or a locale the system lacks, and on Alpine (musl), the connection failed instead. The configuration is not the default: TlsMode defaults to prefer, which checks no certificate.","summary":"hMailServer 6.3.4 through 6.3.7 with MySQL or MariaDB and TlsMode=verify-full silently drops the configured CA file when its name has non-ASCII characters. An attacker who can intercept the database connection can then read and modify traffic, and may obtain the database password.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"hMailServer","fixed":["6.3.8"],"affected":">= 6.3.4, <= 6.3.7","ecosystem":"vendor"},{"name":"MariaDB Connector/C","fixed":["3.4.11"],"affected":">= 3.4.1, <= 3.4.10","ecosystem":"vendor"}],"ecosystems":[],"tags":["hmailserver","linux","mariadb","mysql","package","windows"],"not_affected_if":["ascii-ca-filename","default-config","tlsmode-prefer"],"how_to_check":"- Check hMailServer version: 6.3.4 to 6.3.7 is affected, 6.3.8 fixes it.\n- Check the database settings: exposed only with TlsMode=verify-full on MySQL/MariaDB and a TlsCaFile path containing non-ASCII characters (Linux: any; Windows: above U+00FF). The default TlsMode=prefer is not affected by this flaw.\n- Check the MariaDB Connector/C in use (bundled on Windows in 6.3.4 to 6.3.6, the distribution's libmariadb.so.3 on Linux): versions 3.4.1 to 3.4.10 are the vulnerable range; 3.4.11 fixes CONC-853.\n- Note that hmailserver --check-database and the log still report the configured CA file as checked, so they do not show the problem.","fix":"Upgrade hMailServer to 6.3.8 (2 Nov 2026). The Windows x64 installer bundles MariaDB Connector/C 3.4.11; on Linux use the distribution's Connector/C 3.4.11 or later. Until then, with TlsMode=verify-full give TlsCaFile an ASCII-only path (and ASCII folder names), or set TlsMode=require.","status":"open","published_at":"2026-11-11T09:17:12+00:00","first_seen_at":"2026-11-11T09:26:47+00:00","triaged_at":"2026-11-11T09:28:30+00:00","updated_at":"2026-11-11T09:31:07+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T09:28:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"hMailServer: non-ASCII CA file name disables database certificate checks","impact":"high","summary":"hMailServer 6.3.4 through 6.3.7 with MySQL or MariaDB and TlsMode=verify-full silently drops the configured CA file when its name has non-ASCII characters. An attacker who can intercept the database connection can then read and modify traffic, and may obtain the database password.","audience":"businesses","category":"package","nicknames":[],"who_cares":["hmailserver","mysql","mariadb","windows","linux"],"confidence":0.7,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads and alters database traffic, possibly obtaining database password","analyst_note":"Fixed versions of hMailServer and MariaDB Connector/C are not stated in the sources; check the NVD entry and vendor advisories for patched releases.","how_to_check":"- Check the `TlsMode` and `TlsCaFile` settings in hMailServer's database configuration; the risk needs `TlsMode=verify-full` and a CA file name with non-ASCII characters.\n- Check the hMailServer version in use; `6.3.4` through `6.3.7` are affected.\n- Check the MariaDB Connector/C version bundled or installed; `3.4.1` through `3.4.10` are the affected range.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","tlsmode-prefer","ascii-ca-filename"],"who_is_affected":"Teams running hMailServer 6.3.4 through 6.3.7 with a MySQL or MariaDB database and TlsMode set to verify-full, where the CA file name contains non-ASCII characters. The default TlsMode is prefer, which checks no certificate, so default configurations are not exposed by this flaw. Attacks require the ability to intercept traffic between hMailServer and its database server.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000893,"input_tokens":5433,"output_tokens":700,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed versions of hMailServer and MariaDB Connector/C are not stated in the sources; check the NVD entry and vendor advisories for patched releases.","search":"'+00':118C '-107819':487C '-126610':14A,17A '-2026':13A,16A,486C '-8':534C '-853':336C '1':378C '11.4':348C '127.0.0.1':377C '3.4':343C '3.4.1':390C,452C '3.4.10':153C,270C '3.4.11':340C '3.4.2':151C,268C '3.4.9':454C '6.3.4':28B,77C,275C,462C '6.3.6':277C,464C '6.3.7':30B,79C '8':539C 'abl':407C 'accept':344C 'account':367C 'allow':123C 'alpin':567C 'also':480C 'applic':441C 'ascii':4A,52B,112C 'attack':55B,125C,328C,406C 'author':161C,182C,500C 'bit':540C 'bundl':237C,271C,458C 'byte':547C 'c':199C,205C,558C 'ca':5A,44B,98C,220C,266C,283C,478C 'certif':10A,158C,171C,181C,228C,248C,287C,353C,396C,418C,445C,491C,586C 'chain':303C 'charact':53B,110C,525C,531C 'check':11A,307C,393C,432C,448C,584C 'check-databas':431C 'choos':332C 'client':96C,156C,196C,234C,457C,467C 'conc':335C 'configur':43B,265C,437C,574C 'connect':61B,130C,372C,570C 'connector/c':20A,150C,236C,267C,339C,342C,389C,451C 'contain':108C 'convers':202C 'convert':191C 'could':294C,415C 'cve':12A,15A,485C 'databas':9A,60B,72B,85C,95C,133C,145C,174C,251C,413C,433C,506C 'date':290C,421C 'default':578C,580C 'disabl':8A 'distribut':242C,470C 'drop':41B 'empti':210C 'enough':502C 'error':226C 'fail':571C 'ff':119C 'file':6A,45B,99C,105C,221C,284C,438C,479C,511C,549C 'find':296C 'first':316C 'fix':337C 'found':513C 'full':39B,90C 'give':208C 'glibc':520C 'hand':93C 'hash':323C 'held':365C 'hmailserv':1A,21B,27B,76C,142C,430C 'hmailserver':18A 'hold':527C 'includ':164C 'instead':262C,572C 'intercept':58B,128C 'issu':178C,492C 'issuer':292C,398C 'lack':564C 'later':350C,392C 'lc':556C 'legaci':538C 'line':428C 'linux':22B,114C,245C,469C,509C 'local':206C,376C,405C,523C,535C,555C,561C 'localhost':386C 'log':442C 'make':425C 'mariadb':19A,23B,34B,84C,149C,235C,333C,347C,450C 'may':69B 'met':481C 'method':321C 'middl':331C 'miss':477C 'modifi':66B,138C 'musl':568C 'mysql':24B,32B,82C 'name':7A,48B,102C,107C,167C,177C,193C,215C,299C,306C,383C,401C,435C,496C,529C,552C 'neither':301C,394C 'network':255C 'non':3A,51B 'non-ascii':2A,50B 'obtain':70B,504C 'offer':315C 'one':541C 'otherwis':169C 'outsid':111C 'packag':25B 'password':73B,310C,325C,369C,507C 'patch':474C 'pipe':384C 'precondit':483C 'prefer':582C 'present':147C,416C 'progress':74C 'proof':311C 'prove':363C 'ran':518C 'read':64B,136C 'robot':75C 'runtim':200C 'said':443C 'server':134C,175C,190C,252C,314C,351C,362C,414C,517C 'set':218C,427C,526C 'sign':319C 'sign-in':318C 'silent':40B 'socket':381C 'stand':409C 'stay':230C 'still':434C 'store':188C,261C,355C 'string':211C 'system':185C,258C,543C,563C 'tlscafil':101C 'tlsmode':36B,87C,579C 'took':285C 'traffic':67B,140C 'treat':374C 'trust':187C,260C,499C 'u':117C 'unix':380C 'utf':533C 'verif':229C 'verifi':38B,89C,246C 'verify-ful':37B,88C 'vouch':358C 'went':278C 'whose':291C,524C,546C 'window':26B,121C,239C,273C,388C,460C 'within':288C,419C 'without':224C","nicknames":[],"mitigations":[],"who_affected":"Teams running hMailServer 6.3.4 through 6.3.7 with a MySQL or MariaDB database and TlsMode set to verify-full, where the CA file name contains non-ASCII characters. The default TlsMode is prefer, which checks no certificate, so default configurations are not exposed by this flaw. Attacks require the ability to intercept traffic between hMailServer and its database server.","tier":"B","verified":{"fix":{"at":"2026-11-11T09:31:07Z","by":"analyst","doc":"https://www.progressiverobot.com/hmailserver/Hmail-server/6.3.8/readme.txt","run_id":3530}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["connectorc","hmailserver","mariadbconnectorc"],"ptokens":["connector","hmailserver","mariadb"],"labels":["high","hmailserver","linux","mariadb","mysql","package","windows"],"campaign_type":null,"search_a":"'-126610':14A,17A '-2026':13A,16A 'ascii':4A 'ca':5A 'certif':10A 'check':11A 'connector/c':20A 'cve':12A,15A 'databas':9A 'disabl':8A 'file':6A 'hmailserv':1A 'hmailserver':18A 'mariadb':19A 'name':7A 'non':3A 'non-ascii':2A","search_b":"'6.3.4':28B '6.3.7':30B 'ascii':52B 'attack':55B 'ca':44B 'charact':53B 'configur':43B 'connect':61B 'databas':60B,72B 'drop':41B 'file':45B 'full':39B 'hmailserv':21B,27B 'intercept':58B 'linux':22B 'mariadb':23B,34B 'may':69B 'modifi':66B 'mysql':24B,32B 'name':48B 'non':51B 'non-ascii':50B 'obtain':70B 'packag':25B 'password':73B 'read':64B 'silent':40B 'tlsmode':36B 'traffic':67B 'verifi':38B 'verify-ful':37B 'window':26B","search_c":"'+00':118C '-107819':487C '-2026':486C '-8':534C '-853':336C '1':378C '11.4':348C '127.0.0.1':377C '3.4':343C '3.4.1':390C,452C '3.4.10':153C,270C '3.4.11':340C '3.4.2':151C,268C '3.4.9':454C '6.3.4':77C,275C,462C '6.3.6':277C,464C '6.3.7':79C '8':539C 'abl':407C 'accept':344C 'account':367C 'allow':123C 'alpin':567C 'also':480C 'applic':441C 'ascii':112C 'attack':125C,328C,406C 'author':161C,182C,500C 'bit':540C 'bundl':237C,271C,458C 'byte':547C 'c':199C,205C,558C 'ca':98C,220C,266C,283C,478C 'certif':158C,171C,181C,228C,248C,287C,353C,396C,418C,445C,491C,586C 'chain':303C 'charact':110C,525C,531C 'check':307C,393C,432C,448C,584C 'check-databas':431C 'choos':332C 'client':96C,156C,196C,234C,457C,467C 'conc':335C 'configur':265C,437C,574C 'connect':130C,372C,570C 'connector/c':150C,236C,267C,339C,342C,389C,451C 'contain':108C 'convers':202C 'convert':191C 'could':294C,415C 'cve':485C 'databas':85C,95C,133C,145C,174C,251C,413C,433C,506C 'date':290C,421C 'default':578C,580C 'distribut':242C,470C 'empti':210C 'enough':502C 'error':226C 'fail':571C 'ff':119C 'file':99C,105C,221C,284C,438C,479C,511C,549C 'find':296C 'first':316C 'fix':337C 'found':513C 'full':90C 'give':208C 'glibc':520C 'hand':93C 'hash':323C 'held':365C 'hmailserv':76C,142C,430C 'hold':527C 'includ':164C 'instead':262C,572C 'intercept':128C 'issu':178C,492C 'issuer':292C,398C 'lack':564C 'later':350C,392C 'lc':556C 'legaci':538C 'line':428C 'linux':114C,245C,469C,509C 'local':206C,376C,405C,523C,535C,555C,561C 'localhost':386C 'log':442C 'make':425C 'mariadb':84C,149C,235C,333C,347C,450C 'met':481C 'method':321C 'middl':331C 'miss':477C 'modifi':138C 'musl':568C 'mysql':82C 'name':102C,107C,167C,177C,193C,215C,299C,306C,383C,401C,435C,496C,529C,552C 'neither':301C,394C 'network':255C 'obtain':504C 'offer':315C 'one':541C 'otherwis':169C 'outsid':111C 'password':310C,325C,369C,507C 'patch':474C 'pipe':384C 'precondit':483C 'prefer':582C 'present':147C,416C 'progress':74C 'proof':311C 'prove':363C 'ran':518C 'read':136C 'robot':75C 'runtim':200C 'said':443C 'server':134C,175C,190C,252C,314C,351C,362C,414C,517C 'set':218C,427C,526C 'sign':319C 'sign-in':318C 'socket':381C 'stand':409C 'stay':230C 'still':434C 'store':188C,261C,355C 'string':211C 'system':185C,258C,543C,563C 'tlscafil':101C 'tlsmode':87C,579C 'took':285C 'traffic':140C 'treat':374C 'trust':187C,260C,499C 'u':117C 'unix':380C 'utf':533C 'verif':229C 'verifi':89C,246C 'verify-ful':88C 'vouch':358C 'went':278C 'whose':291C,524C,546C 'window':121C,239C,273C,388C,460C 'within':288C,419C 'without':224C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T09:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126610","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126610","severity":null,"published_at":"2026-11-11T09:17:12+00:00","modified_at":"2026-11-11T09:17:12+00:00","first_seen_at":"2026-11-11T09:26:47+00:00","fetched_at":"2026-11-11T09:26:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126610:3530","url":"https://www.progressiverobot.com/hmailserver/Hmail-server/6.3.8/readme.txt","severity":null,"published_at":"2026-11-11T09:31:07+00:00","modified_at":"2026-11-11T09:31:07+00:00","first_seen_at":"2026-11-11T09:31:07+00:00","fetched_at":"2026-11-11T09:31:07+00:00","note":"Fix 6.3.8 / Connector/C 3.4.11 read in the project's 6.3.8 release notes; the NVD text gave the details. Fix verified only; other fields left unmarked. No mitigations or public discussion searched (new, low-profile CVE).","cites":["https://www.progressiverobot.com/hmailserver/Hmail-server/6.3.8/readme.txt","https://nvd.nist.gov/vuln/detail/CVE-2026-126610"]}],"documents":[{"id":124361,"url":"https://www.progressiverobot.com/hmailserver/Hmail-server/6.3.8/readme.txt","title":"hMailServer 6.3.8 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":124362,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126610","title":"NVD CVE-2026-126610","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}