{"id":"CVE-2026-114472","revision":null,"records":[{"revision":"854620b03ac94e0cb9c6936884fd4383","observedAt":"2026-10-29T21:48:56.968+00:00","statement":{"source":"cve-program","id":"CVE-2026-114472","aliases":[],"title":"Insufficient Resource Pool in hMailServer","description":"Insufficient resource pool in the ACME HTTP-01 challenge responder of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to cause a certificate issuance or renewal to fail. When the server obtains or renews a TLS certificate over ACME it runs an HTTP-01 challenge responder on port 80 for the certificate authority to read the challenge token; the responder served one connection at a time, accepting a socket, waiting up to five seconds to receive a request, answering it, and only then accepting the next. A client that connected and sent nothing held the single worker for the whole timeout, so enough idle connections during a validation keep the certificate authority's own request from being answered in time and the validation fails. Sustained across a certificate's renewals this leads to the certificate expiring, after which clients refuse the server's TLS; the mail service itself continues on its current certificate until then. No authentication is required to connect to the responder. Version 6.3.7 serves up to 64 connections at once and closes a connection past that, so that where a handful of idle connections, one after another, sufficed before, a client must keep 64 idle connections open at once throughout a validation to have the certificate authority's connection closed.","state":0,"publishedAt":"2026-10-21T15:11:55.846+00:00","modifiedAt":"2026-10-29T20:56:32.293+00:00","affected":[{"ecosystem":"Vendor product","name":"hMailServer","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Progressive Robot Ltd\",\n                    \"product\": \"hMailServer\",\n                    \"repo\": \"https://gitlab.com/hmailserver/hmailserver\",\n                    \"versions\": [\n                        {\n                            \"version\": \"6.0.0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"6.3.6\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","score":3.7,"severity":"LOW"}],"references":["https://gitlab.com/hmailserver/hmailserver/-/work_items/97","https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114472","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-114472","identifiers":["CVE-2026-114472"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T01:26:54.7341767+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T01:26:54.7341767+00:00","lastSuccessAt":"2026-11-07T01:26:54.8876863+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:26:54.8876872+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-e3f76855f3f449c8c0427e4ebd06d00838fa519af10fe158fc0ca4a62af0718a-340a45d9017d4f9de046b855ad9d1afbc5c699f0e6a7003981ff3a54ebedd5b3","complete":true,"records":420470,"lastAttemptAt":"2026-11-07T01:26:54.2134599+00:00","lastSuccessAt":"2026-11-06T23:27:15.9170833+00:00","error":"InvalidOperationException","lastVerifiedAt":"2026-11-07T00:26:54.2874398+00:00","snapshotPublishedAt":"2026-11-06T23:24:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1e21f19531e44b2e94a04caf6ae93614","complete":true,"records":13623,"lastAttemptAt":"2026-11-07T01:38:26.744654+00:00","lastSuccessAt":"2026-11-07T01:38:26.741+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:38:26.741+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T01:26:54.7341767+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T01:26:54.7341767+00:00","lastSuccessAt":"2026-11-07T01:26:54.8884513+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:26:54.8884516+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-34343b4ea57e47c5a482c8fcf20a381e","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T01:26:55.9490879+00:00","lastSuccessAt":"2026-11-07T01:26:55.938+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:26:55.938+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T01:26:54.5768376+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:26:54.5768376+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T01:26:54.3688172+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:26:54.3688172+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T01:26:54.6823337+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:26:54.6823337+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-a0b728bc1c5526b5429930c00621636eba8655069c176697c3080f8377619ad7","complete":true,"records":231291,"lastAttemptAt":"2026-11-07T01:26:54.4691469+00:00","lastSuccessAt":"2026-11-07T00:28:51.1983528+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:26:54.4691469+00:00","snapshotPublishedAt":"2026-11-06T23:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}