CVE-2026-103649

{
  "etk_id": "ETK-2026-967",
  "cve_id": "CVE-2026-103649",
  "display_id": "CVE-2026-103649",
  "ghsa_id": "GHSA-69m7-r4p2-rfcq",
  "euvd_id": "EUVD-2026-94835",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing network timeouts denial of service in hMailServer",
  "summary": "Linux builds of hMailServer 6.3.0 through 6.3.5 can leave server threads occupied when network peers do not respond, disrupting outbound mail delivery or affected listener services. An attacker needs to be able to induce a connection to an attacker-controlled or unresponsive remote endpoint, or connect silently to an affected listener.",
  "mitigation": "Upgrade hMailServer to version 6.3.6. Until upgrading, restrict access to affected listeners and limit outbound connections to untrusted destinations where operationally possible.",
  "vendor": "Progressive Robot Ltd",
  "product": "hMailServer",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 6.3.0, < 6.3.6"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "6.3.6"
      ],
      "package_name": "hMailServer",
      "purl": null
    }
  ],
  "cwes": [
    1088
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": 0.0027,
  "epss_percentile": 0.1812,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 69.42675293333333,
  "t0_at": "2026-10-08T10:53:00.630000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-08T10:53:00.630000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T10:53:00.630000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103649"
    }
  }
}