hMailServer 6.3.4

Security

A password could run code inside the server. On Windows, with event scripting on, the language set to JScript and an OnClientValidatePassword handler, any client that could reach a sign-in and name an existing, active account could run JScript inside hMailServer.exe before authenticating, and with the shipped ScriptAllowedObjects=* that meant any command the service's account may run. A remote POP3 server's UID (OnExternalAccountDownload) and a remote mail server's error text (OnDeliveryFailed) reached the same flaw on servers with those handlers, and a rule's Run function name, which anyone who may edit rules sets, reached it in either language. VBScript servers were not open through a password, a UID or an error text, and the Linux builds had no script engine. Every JScript value is now escaped in one helper, and a rule's function name must be a plain identifier. The release notes place the flaw in every release from 6.0.0 to 6.3.3, a range the project is still checking against those releases' code (GitLab issue 27); treat any server older than 6.3.4 with event scripting on as affected. The flaw is assigned CVE-2026-100741; its public record had not been published when this was written. Until you can upgrade a JScript server, switch event scripting off; or take those three handlers out of EventHandlers.js, reload the scripts, and let nobody but the server administrator make or edit a rule with a Run function action, which is open in VBScript too.

Fifty-two defects found by an audit before this release, fixed. The audit read SMTP and the sign-ins, IMAP, HTTP and the REST API, identity, cryptography, outbound connections, files and personal data, and the database, and confirmed 52 defects, 8 of them rated high. Many were in code new in this release. Among those 6.3.3 had too: SCRAM-SHA-256 accepted the account's own password where a second factor or an expired password should have refused it; two IMAP sessions changing one message's keywords could corrupt the heap and end the service, and two changing its flags could lose one of the changes; an IMAP APPEND whose client went away before its last line left a message file no quota counted, which an authenticated user could repeat until the volume was full; and an app password could read the account's S/MIME keys and replace them. On a server that collects Microsoft 365 mail with its own OAuth2 app token, a domain administrator could, over COM since 6.2.23 Alpha 1, add a fetch account that copied, and could delete, any mailbox that token reaches.

Seven defects GitLab's SAST scan found, fixed. The crash-dump helper loaded dbghelp.dll by name, so a copy put in Bin would have run under the service's account at the next crash; the Control Panel's elevated service restart started cmd.exe by name; the installer handed the administrator password to DBSetupQuick.exe, and it to DBUpdater.exe, unquoted on their command lines, where it is now handed on in the environment (HM_ADMIN_PASSWORD); a backup index cut short or altered was read past its end on restore, in two places; and a test of the MIME parser compared pointers into two different arrays. Found beside them and fixed too: a custom virus scanner whose command line holds a bare %FILE%, outside double quotes, was handed the message's path cut at its first space (the default data directory has one), so it scanned nothing and the message was delivered as clean.

The release was published only once build/ci/security-gate.py had passed the scans of its commit (cppcheck and clang-tidy, Semgrep, GitLab's Semgrep analyser and the dependency scan with Trivy and OSV), run by hand on the project's Linux machine, as the release job is to run them from 6.3.5.

What changes without a switch

The full list is the first part of 6.3.4's section in CHANGELOG.md. In short:

• The database becomes the settings store: the [Settings] section of hMailServer.ini is taken in at the first start, and from then on a line edited in the file is put back (HM5804). Change settings in the Control Panel, over COM or REST, or with hmailserver --set-setting on Linux.
• SPF follows RFC 7208: mail from 127.0.0.0/8 and ::1 no longer passes unconditionally, so a content filter that hands mail back to the server should authenticate, or connect from an IP range with anti-spam off.
• The audit trail and the alerts are on (nothing is mailed until a recipient is set); compromised-account detection runs in watch mode; a destination that asks the server to slow down is paused.
• MySQL and MariaDB connections use TLS whenever the database server offers it, and SQL Server sessions are encrypted through the Microsoft OLE DB Driver 18 or later (MSOLEDBSQL) and, beside a failover partner, SQL Server Native Client, both without checking the certificate unless [Database] TlsMode=verify-full. Through the older SQLOLEDB, used where that driver is not installed and no failover partner is set, only the login is encrypted unless TlsMode is require or verify-full.
• The administrator password is hashed again as PBKDF2 at the first sign-in; the installer had written an unsalted MD5.
• A one-time code is taken once, over COM and REST. A script that sent the administrator's password and a code with every REST request now signs in once (POST /api/v1/session) or uses an API key; otherwise only its first request in each half minute is accepted.
• A route or the SMTP relay whose host is on OutboundOAuth2Hosts sends the server's token over TLS only. Without TLS the delivery fails with a temporary 450 4.7.0, and HM5912 says to require TLS or STARTTLS.
• A COM change to a route, relay, DNS black list, SURBL server, remote-domain policy, server message, blocked attachment, SSL certificate or group is in effect only after Save().
• IMAP follows the RFCs where Dovecot's imaptest found it did not: some answers change from BAD to NO, and an APPEND stores the literal byte for byte.
• A restore refuses an archive with an absolute path, a .. or a link in it; the installer's 7-Zip is 26.03. A rule's Run function action must name a plain function. ISO-8859-1 mail is decoded as windows-1252.
• Addresses collected from what a person sends are suggestions, under Other contacts in the webmail, and CardDAV serves only the contacts a person kept.
• A domain may no longer be named as one of the directories the server keeps its own files in (protected, confidential, recoverable, discovery, quarantine, files, lists, blobs and the rest); one that already is is reported at every start as HM7597 and on the setup checklist. Rename it.
• Only a new installation whose database the installer created gets STARTTLS on 25, 587, 110 and 143 with a self-signed certificate, TLS required for sign-in from outside, the Windows service as NT SERVICE\hMailServer, and, on Windows or in the container, a stored-secrets key. An upgrade, or a new installation attached to an existing database, keeps its listeners, its service account and its secrets as they were; sealing the stored secrets starts once an administrator runs --create-stored-secrets-key, which the setup checklist offers.

What is new

Most of it is off until an administrator turns it on. Each item has its operator document, linked from its row in CHANGELOG.md.

• Mail flow: remote-domain policies, per-destination throttling and IP warm-up, a send API for applications, DKIM key rotation, journaling, restricted delivery, message recall, and mail in to a webhook.
• Anti-spam: greylisting with more checks, SMTP policy rules, allow and block lists with quarantine digests, mail flow rules with an outbound content policy, impersonation protection, attachment sandboxing, spam traps and country blocking.
• Webmail and clients: CalDAV and calendars with invitations, free-busy and delegation, rooms and equipment that answer bookings, contact groups and a directory, recover deleted items, expiring messages, offline mail, Web Push, OpenPGP in the browser, and a folder of a hundred thousand messages listed, searched and selected in bounded steps.
• Identity: administrator roles, passkeys, OpenID Connect and SAML sign-in, SCIM provisioning, self-service password reset, sessions and devices, breached-password checks.
• Encryption: zero-access mailboxes, mailbox encryption at rest, gateway encryption to partner domains, an organisation CA for S/MIME, Web Key Directory, and sealed stored secrets.
• Compliance and administration: eDiscovery with legal holds and verifiable exports, an erasure that reaches the stores beside the mailbox, settings at server, domain and account level, profiles, hmctl and a PowerShell module, a setup checklist, and help beside every page.
• Migration: resumable migrations from IMAP, Google Workspace and Microsoft 365, and PST import, whose reader runs in a process of its own.
• Operations: storage compression and attachment de-duplication, object storage (S3 or Azure Blob), encrypted backups, upgrades that apply the schema at start, event scripts on Linux in JavaScript, SNMPv3, syslog, webhooks and per-domain reports.

The project, off GitHub

The project's home is GitLab, at gitlab.com/hmailserver/hmailserver, with issue templates for a bug, a feature, a question and a security report, and a Service Desk address for anyone without a GitLab account: a bug report or a question for the maintainers emailed to contact-project+hmailserver-hmailserver-86730559-issue-@incoming.gitlab.com becomes a confidential issue, which only the maintainers see. Every release up to 6.3.3 is re-published there with its files byte for byte, except 6.2.0 and 6.0.0-B4, whose files were not preserved. 6.3.4 was built and released by hand. From 6.3.5 a release is to be made by the project's GitLab pipeline, from a protected release tag that only the owner may create, with every file signed with Sigstore, and held while the security scans of the tagged commit find something the policy counts that is not accepted. Report a vulnerability privately, by one of the two routes in SECURITY.md: a confidential GitLab issue, or an email to the project's Service Desk address, which GitLab files as a confidential issue. Never in a forum thread or a public issue.

Downloads

hMailServer-6.3.4-x64.exe is the Windows x64 installer, Authenticode-signed by Progressive Robot Ltd through Azure Artifact Signing. hmailserver_6.3.4_amd64.deb and hmailserver-6.3.4-1.x86_64.rpm are the Linux packages, for x86-64 only; there are no AArch64 packages, since the project has no ARM machine to build them on, and no AppImage, which the pipeline does not build yet. Each of those three files has its own SBOM beside it, named after it with .cdx.json (CycloneDX 1.6), whose subject is that file by its SHA-256; hmailserver.spdx.json and hmailserver.cyclonedx.json describe the source tree. hmailserver-6.3.4-SHA256SUMS.txt lists the SHA-256 of each of those eight files, and hmailserver-6.3.4-SHA256SUMS.txt.sig is its SSH signature. There is no Sigstore bundle. The newest stable release's files are also at fixed addresses that never lead to a pre-release: updates.progressiverobot.com/download/hMailServer-x64.exe, /download/hmailserver_amd64.deb and /download/hmailserver.x86_64.rpm.

Verification

On Windows, Get-AuthenticodeSignature .\hMailServer-6.3.4-x64.exe should answer Valid, signed by CN=Progressive Robot Ltd. The checksum list is signed with the SSH key that signs the release tags, whose public half is .gitlab/allowed_signers in the repository at the tag; save that file as allowed_signers beside the downloads. With OpenSSH 8.1 or later, the first command must answer Good "file" signature for [email protected], and the second OK for every file you downloaded:

ssh-keygen -Y verify -f allowed_signers -I [email protected] -n file \
-s hmailserver-6.3.4-SHA256SUMS.txt.sig < hmailserver-6.3.4-SHA256SUMS.txt

sha256sum --ignore-missing \
-c hmailserver-6.3.4-SHA256SUMS.txt

In a clone, the tag itself verifies against the same file with git -c gpg.ssh.allowedSignersFile=.gitlab/allowed_signers verify-tag v6.3.4.

Reproducible. hMailServer.exe 6.3.4.43 was built twice from clean at v6.3.4 (commit 51e2dbda08d6aa7fcda5a48f1af05221809f78be), and the two builds were byte-identical: SHA-256 d18edf6f82b874e7e1d25dd9cbb4f4162956c106ac263dc4a92a991d1fb71b4c, 40,067,584 bytes, built with MSBuild 18.9.1, MSVC tools 14.51.36231, the v145 toolset and Windows SDK 10.0.26100.0. The installer carries that file as built; only the installer itself is signed.

Linux. The .deb and the .rpm were built from the tag in the CI image hmailserver-ci/linux:26.04-dad0ab749505, with SOURCE_DATE_EPOCH set to the tag commit's own time (1790467550). The server binary as built, before CPack strips it for the packages, has SHA-256 e8a4d05590cf3434eec6a0b8e178a06efc53e46fee973a753e3e17561dea02b5.

Fuzzing. The three MIME fuzzers ran for 30 minutes each on 27 September 2026 at v6.3.4, after replaying the committed reproducers and the seeds made from the test messages: 32,524,829 executions in all, and nothing found.

Software bills of materials. To check that an SBOM describes your download, compare the SHA-256 in its metadata.component.hashes with the file's own; the SBOMs are in hmailserver-6.3.4-SHA256SUMS.txt with every other file.

Known issues

• No live update installs 6.3.4, as above. On a server whose service runs as NT SERVICE\hMailServer, the live update will not apply later releases either; an administrator runs the installer.
• No container image of 6.3.4. The images on ghcr.io answer 404 since the suspension, and the Compose file and the Helm chart name registry.gitlab.com/progressiverobot/hmailserver, which is empty; the release pipeline pushes and signs the image from the first release after the project's move to the group hmailserver and the owner's switch.
• Linux is x86-64 only in this release, and there is no apt or dnf repository yet. Windows on ARM is compiled but has never run; there is no ARM64 installer.
• No published performance numbers yet; the load generator and the lab recipe are in the tree.
• Four of imaptest's 71 scripts still fail: \Recent in FETCH FLAGS, the zone of an APPEND's INTERNALDATE, \NonExistent, and MIME boundary padding.
• Mailbox encryption at rest has no webmail card and no Control Panel page, and a search in an encrypted mailbox reads every message. With object storage, Message.Filename over COM names the local path the message would have; read the message through the API.
• PST import refuses the 4K-page layout, files under Windows Information Protection and OSTs that cache an Exchange mailbox. eDiscovery exports EML and mbox, not PST, up to 4 GB, and downloads an export only up to 500 MB; a larger one is left on the server's disk, and the 413 says where.
• SCRAM-SHA-256 does not consult the OnClientValidatePassword script hook. Journal rules do not see mail the server queues itself: the webmail's, a send-later draft, an event script's, a rule's forward, copy or reply, an automatic reply, a Sieve redirect, an account's forwarding and a delivery report.
• The installer's own /adminpassword= switch is on its command line, where anybody listing processes can read it, and cannot carry a double quote; an unattended install can give the installer the password in HM_ADMIN_PASSWORD instead, set in an elevated prompt, since the variable does not cross the UAC prompt.
• The SNMP agent's enterprise number is RFC 5612's documentation number, not one registered to this project.
• The security scans on the project's own CI runners hold a release, not a change: they do not stop a push's pipeline yet, and the static analysis still reports findings not yet read into its baseline.