CVE-2026-114472: CWE-410: Insufficient Resource Pool in Progressive Robot Ltd hMailServer

The vulnerability in hMailServer's ACME HTTP-01 challenge responder arises from its design to handle only one connection at a time on port 80 during TLS certificate issuance or renewal. An unauthenticated remote attacker can connect and send no data, occupying the single worker slot for up to five seconds. By sustaining multiple such idle connections, the attacker can prevent the certificate authority's validation request from being processed in time, causing the certificate issuance or renewal to fail. Over time, this leads to certificate expiration and clients refusing TLS connections to the server. The issue affects hMailServer versions 6.0.0 through 6.3.6. The vendor addressed this in version 6.3.7 by increasing the number of concurrent connections to 64, significantly raising the attacker's resource requirements to cause the same disruption.

The impact is limited to denial of service against the certificate issuance or renewal process, potentially causing TLS certificates to expire and clients to refuse TLS connections. The mail service itself continues to operate with the current certificate until it expires. There is no confidentiality or integrity impact, and no authentication is required to exploit this denial of service condition. The CVSS score is 3.7 (low severity), reflecting the limited impact and the requirement for multiple idle connections to cause disruption.

Upgrade hMailServer to version 6.3.7 or later, which increases the number of simultaneous connections the ACME HTTP-01 challenge responder can handle from one to 64. This change significantly reduces the feasibility of denial of service attacks against certificate issuance or renewal by requiring an attacker to maintain many idle connections concurrently. No other specific mitigations are indicated.