{"id":"CVE-2026-126616","kind":"vulnerability","aliases":["CVE-2026-126616"],"related":[],"title":"hMailServer: auto-ban can be bypassed with 4-byte characters in usernames","description":"The auto-ban of Progressive Robot hMailServer 6.2.0 through 6.3.3, with a MySQL or MariaDB database, can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker to go on guessing account passwords from a single address without being banned. The server makes its MySQL tables in MySQL's utf8 character set, which holds no character outside the Basic Multilingual Plane, sends its statements as UTF-8 over a utf8mb4 connection and leaves the database's default strict mode in place. From 6.2.0 it decodes the user name of a SASL PLAIN logon as UTF-8, so the name can hold such a character. When the failed logons counted from one address reach MaxInvalidLogonAttempts (3 by default), the server clears that address's count, saves an IP range named \"Auto-ban: \" followed by the user name of the logon that reached the limit, and drops the connection. If such a character is in the part of the user name that the range's name keeps (the name is cut to 100 characters), the database refuses the range: no range is saved, the address is not refused, and, its count having already been cleared, it is given the next full set of attempts. An attacker can in this way spend all but the last attempt of each set on password guesses, and make the last under such a name. On Windows, POP3 AUTH PLAIN reaches it on a server as installed, and IMAP AUTHENTICATE PLAIN where IMAP SASL authentication is turned on (off by default); on Windows and on Linux (from 6.3.0), SMTP AUTH PLAIN reaches it where plain-text authentication is allowed (off by default), and ManageSieve and CardDAV where they are turned on (off by default). Each failed save is reported in the server's error log. A database whose strict mode has been turned off stores the character as a question mark and makes the first such ban, but refuses every later ban named after the same user name, or after one holding other such characters in their place, as a duplicate while the first stands, since the server cannot look up a name holding such a character there.","summary":"hMailServer 6.2.0 through 6.3.3 with MySQL or MariaDB fails to save the auto-ban range when a SASL PLAIN username contains a character outside the Basic Multilingual Plane. An unauthenticated attacker can keep guessing passwords from one address without being banned.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"hMailServer","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["email","hmailserver","linux","mariadb","mysql","other","windows"],"not_affected_if":["auth-features-disabled","other-database"],"how_to_check":"- Check the hMailServer version in the installed application (`6.2.0` through `6.3.3` are affected per the source).\n- Check whether the database backend is MySQL or MariaDB.\n- Check the error log for failed saves of IP ranges named \"Auto-ban: \".","fix":null,"status":"open","published_at":"2026-11-11T09:17:13+00:00","first_seen_at":"2026-11-11T09:26:48+00:00","triaged_at":"2026-11-11T09:28:44+00:00","updated_at":"2026-11-11T09:28:44+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T09:28:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"hMailServer: auto-ban can be bypassed with 4-byte characters in usernames","impact":"medium","summary":"hMailServer 6.2.0 through 6.3.3 with MySQL or MariaDB fails to save the auto-ban range when a SASL PLAIN username contains a character outside the Basic Multilingual Plane. An unauthenticated attacker can keep guessing passwords from one address without being banned.","audience":"businesses","category":"other","nicknames":[],"who_cares":["hmailserver","mysql","mariadb","email","windows","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker guesses passwords from one address without being banned","analyst_note":"Confirm the fixed version and any vendor fix from the NVD entry or the vendor advisory; sources give none.","how_to_check":"- Check the hMailServer version in the installed application (`6.2.0` through `6.3.3` are affected per the source).\n- Check whether the database backend is MySQL or MariaDB.\n- Check the error log for failed saves of IP ranges named \"Auto-ban: \".","plain_action":"","product_name":"hMailServer","needs_analyst":true,"not_affected_if":["other-database","auth-features-disabled"],"who_is_affected":"Servers running hMailServer 6.2.0 through 6.3.3 with a MySQL or MariaDB database are affected. POP3 AUTH PLAIN is exposed on Windows installs by default; IMAP, SMTP, ManageSieve and CardDAV need their optional features enabled. Installations on other databases or outside the listed versions are not described as affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000832,"input_tokens":5136,"output_tokens":637,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126616':16A,19A '-2026':15A,18A '-8':143C,172C '100':248C '3':191C '4':9A '6.2.0':29B,78C,159C '6.3.0':338C '6.3.3':31B,80C 'account':108C 'address':66B,93C,113C,188C,198C,260C 'allow':99C,350C 'alreadi':268C 'attack':59B,103C,281C 'attempt':279C,291C 'auth':309C,340C 'authent':320C,325C,348C 'auto':3A,41B,72C,207C 'auto-ban':2A,40B,71C,206C 'ban':4A,42B,69B,73C,91C,116C,208C,398C,403C 'basic':54B,135C 'bypass':7A 'byte':10A 'cannot':430C 'carddav':357C 'charact':11A,51B,127C,132C,180C,228C,249C,388C,416C,438C 'clear':196C,270C 'connect':147C,224C 'contain':49B 'count':185C,200C,266C 'cut':246C 'cve':14A,17A 'databas':86C,151C,251C,378C 'decod':161C 'default':153C,193C,331C,353C,365C 'drop':222C 'duplic':422C 'email':21B 'error':375C 'everi':401C 'fail':36B,96C,183C,367C 'first':396C,425C 'follow':209C 'full':276C 'given':273C 'go':105C 'guess':62B,107C,297C 'hmailserv':1A,22B,28B,77C 'hmailserver':20A 'hold':130C,177C,413C,435C 'imap':319C,323C 'instal':317C 'ip':203C 'keep':61B,242C 'kept':89C 'last':290C,301C 'later':402C 'leav':149C 'limit':220C 'linux':23B,336C 'log':376C 'logon':97C,169C,184C,216C 'look':431C 'make':119C,299C,394C 'managesiev':355C 'mariadb':24B,35B,85C 'mark':392C 'maxinvalidlogonattempt':190C 'mode':155C,381C 'multilingu':55B,136C 'mysql':25B,33B,83C,121C,124C 'name':164C,175C,205C,213C,236C,241C,244C,305C,404C,409C,434C 'next':275C 'one':65B,187C,412C 'outsid':52B,133C 'part':232C 'password':63B,109C,296C 'place':157C,419C 'plain':47B,168C,310C,321C,341C,346C 'plain-text':345C 'plane':56B,137C 'pop3':308C 'progress':75C 'question':391C 'rang':43B,204C,239C,254C,256C 'reach':189C,218C,311C,342C 'refus':252C,263C,400C 'remot':101C 'repeat':95C 'report':370C 'robot':76C 'sasl':46B,167C,324C 'save':38B,201C,258C,368C 'send':138C 'server':118C,195C,315C,373C,429C 'set':128C,277C,294C 'sinc':427C 'singl':112C 'smtp':339C 'spend':286C 'stand':426C 'statement':140C 'store':386C 'strict':154C,380C 'tabl':122C 'text':347C 'turn':327C,361C,384C 'unauthent':58B,102C 'user':163C,212C,235C,408C 'usernam':13A,48B 'utf':142C,171C 'utf8':126C 'utf8mb4':146C 'way':285C 'whose':379C 'window':27B,307C,333C 'without':67B,114C","nicknames":[],"mitigations":[],"who_affected":"Servers running hMailServer 6.2.0 through 6.3.3 with a MySQL or MariaDB database are affected. POP3 AUTH PLAIN is exposed on Windows installs by default; IMAP, SMTP, ManageSieve and CardDAV need their optional features enabled. Installations on other databases or outside the listed versions are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["hmailserver"],"ptokens":["hmailserver"],"labels":["email","hmailserver","linux","mariadb","medium","mysql","other","vendor","windows"],"campaign_type":null,"search_a":"'-126616':16A,19A '-2026':15A,18A '4':9A 'auto':3A 'auto-ban':2A 'ban':4A 'bypass':7A 'byte':10A 'charact':11A 'cve':14A,17A 'hmailserv':1A 'hmailserver':20A 'usernam':13A","search_b":"'6.2.0':29B '6.3.3':31B 'address':66B 'attack':59B 'auto':41B 'auto-ban':40B 'ban':42B,69B 'basic':54B 'charact':51B 'contain':49B 'email':21B 'fail':36B 'guess':62B 'hmailserv':22B,28B 'keep':61B 'linux':23B 'mariadb':24B,35B 'multilingu':55B 'mysql':25B,33B 'one':65B 'outsid':52B 'password':63B 'plain':47B 'plane':56B 'rang':43B 'sasl':46B 'save':38B 'unauthent':58B 'usernam':48B 'window':27B 'without':67B","search_c":"'-8':143C,172C '100':248C '3':191C '6.2.0':78C,159C '6.3.0':338C '6.3.3':80C 'account':108C 'address':93C,113C,188C,198C,260C 'allow':99C,350C 'alreadi':268C 'attack':103C,281C 'attempt':279C,291C 'auth':309C,340C 'authent':320C,325C,348C 'auto':72C,207C 'auto-ban':71C,206C 'ban':73C,91C,116C,208C,398C,403C 'basic':135C 'cannot':430C 'carddav':357C 'charact':127C,132C,180C,228C,249C,388C,416C,438C 'clear':196C,270C 'connect':147C,224C 'count':185C,200C,266C 'cut':246C 'databas':86C,151C,251C,378C 'decod':161C 'default':153C,193C,331C,353C,365C 'drop':222C 'duplic':422C 'error':375C 'everi':401C 'fail':96C,183C,367C 'first':396C,425C 'follow':209C 'full':276C 'given':273C 'go':105C 'guess':107C,297C 'hmailserv':77C 'hold':130C,177C,413C,435C 'imap':319C,323C 'instal':317C 'ip':203C 'keep':242C 'kept':89C 'last':290C,301C 'later':402C 'leav':149C 'limit':220C 'linux':336C 'log':376C 'logon':97C,169C,184C,216C 'look':431C 'make':119C,299C,394C 'managesiev':355C 'mariadb':85C 'mark':392C 'maxinvalidlogonattempt':190C 'mode':155C,381C 'multilingu':136C 'mysql':83C,121C,124C 'name':164C,175C,205C,213C,236C,241C,244C,305C,404C,409C,434C 'next':275C 'one':187C,412C 'outsid':133C 'part':232C 'password':109C,296C 'place':157C,419C 'plain':168C,310C,321C,341C,346C 'plain-text':345C 'plane':137C 'pop3':308C 'progress':75C 'question':391C 'rang':204C,239C,254C,256C 'reach':189C,218C,311C,342C 'refus':252C,263C,400C 'remot':101C 'repeat':95C 'report':370C 'robot':76C 'sasl':167C,324C 'save':201C,258C,368C 'send':138C 'server':118C,195C,315C,373C,429C 'set':128C,277C,294C 'sinc':427C 'singl':112C 'smtp':339C 'spend':286C 'stand':426C 'statement':140C 'store':386C 'strict':154C,380C 'tabl':122C 'text':347C 'turn':327C,361C,384C 'unauthent':102C 'user':163C,212C,235C,408C 'utf':142C,171C 'utf8':126C 'utf8mb4':146C 'way':285C 'whose':379C 'window':307C,333C 'without':114C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T09:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126616","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126616","severity":null,"published_at":"2026-11-11T09:17:13+00:00","modified_at":"2026-11-11T09:17:13+00:00","first_seen_at":"2026-11-11T09:26:48+00:00","fetched_at":"2026-11-11T09:26:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}