CVE-2026-107584

{
  "etk_id": "ETK-2026-1287",
  "cve_id": "CVE-2026-107584",
  "display_id": "CVE-2026-107584",
  "ghsa_id": "GHSA-m2j8-89fm-cxjh",
  "euvd_id": "EUVD-2026-94867",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Fail-open DANE validation in hMailServer",
  "summary": "hMailServer 6.0.0 through 6.3.5 can treat certain failed or unverifiable DNSSEC lookups as though a recipient domain is unsigned during outbound SMTP delivery. An attacker able to manipulate relevant DNS traffic and intercept the SMTP path could bypass DANE protections, exposing messages to interception or modification.",
  "mitigation": "Upgrade hMailServer to version 6.3.6 or later. Until upgraded, reduce exposure by securing resolver and DNS transport paths and limiting untrusted network access to SMTP traffic.",
  "vendor": "Progressive Robot Ltd",
  "product": "hMailServer",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 6.0.0, < 6.3.6"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "6.3.6"
      ],
      "package_name": "hMailServer",
      "purl": null
    }
  ],
  "cwes": [
    636
  ],
  "cvss_score": 7.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0015,
  "epss_percentile": 0.0388,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 10.178174816666667,
  "t0_at": "2026-10-08T11:49:16.083000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-12T03:27:59.598958+00:00",
      "days": 3.651892545810185,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T11:49:16.083000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-08T11:49:16.083000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T11:49:16.083000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107584"
    }
  }
}