CVE-2026-126626: Progressive Robot hMailServer denial of service in web services listener

CVE-2026-126626 · Severity: medium · CVSS 5.3 · Published 2026-11-11

hMailServer is an email server software that provides mail services including SMTP, POP3, and IMAP. A flaw in its web services listener causes it to incorrectly count failed login attempts from proxy servers it trusts, leading to those proxies being automatically banned from mail services. This can lock out all email clients and local mail-dependent services behind the affected proxy.

Technologies: Progressive Robot hMailServer. Vendors: Progressive Robot.

Quick answers

Is CVE-2026-126626 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126626 being exploited in the wild.
How severe is CVE-2026-126626?
Medium severity, with a CVSS score of 5.3, published 11 November 2026.
Which products and versions are affected?
Progressive Robot hMailServer 6.3.3 through 6.3.7.
Is there a fix for CVE-2026-126626?
No fixed version is recorded yet. Disable the web services listener by setting WebServicesHttpPort and WebServicesHttpsPort to 0, or add proxy IP addresses to the AutoBanNeverBan configuration to prevent them from being auto-banned on failed authentication attempts.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-11-11"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-126626 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-126626?
Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable the web services listener by setting WebServicesHttpPort and WebServicesHttpsPort to 0, or add proxy IP addresses to the AutoBanNeverBan configuration to prevent them from being auto-banned on failed authentication attempts.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-11-11"}]

Technical details

The web services listener fails to parse the X-Forwarded-For header from trusted proxies, instead counting failed CardDAV, CalDAV, and Autodiscover authentication attempts against the proxy's own IP address. This triggers an automatic IP ban after MaxInvalidLogonAttempts failures, blocking the proxy at SMTP, POP3, IMAP, and ManageSieve listeners. On loopback proxies, local webmail and mail client services are disabled; on remote proxies, all downstream mail clients are affected.

Affected products

  • Progressive Robot hMailServer 6.3.3 through 6.3.7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.