{"id":"CVE-2026-100741","summary":"Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer","details":"Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a password containing a backslash followed by an apostrophe, sent in any logon (SMTP AUTH, POP3, IMAP) that names an existing, active account. Exploitation requires a non-default configuration: event scripting enabled (off by default), the script language set to JScript (the default is VBScript), and an OnClientValidatePassword handler defined in the event script. The server wrote event values into the handler call as JScript string literals, escaping the apostrophe but not the backslash, so such a value closes the literal and the rest of it is parsed as script. The same flaw is reachable by a remote POP3 server through the message UID it returns, where an OnExternalAccountDownload handler is defined, and by a remote SMTP server through the error reply it rejects a delivery with, where an OnDeliveryFailed handler is defined. Before 6.2.25 the injected script can create any COM object, and from 6.2.25 it can with the default ScriptAllowedObjects value of '*'; WScript.Shell among them gives command execution as the service account. VBScript event scripts and the Linux builds of Progressive Robot Ltd's hMailServer are not affected.","modified":"2026-11-11T13:19:35.909525170Z","published":"2026-09-27T07:12:54.503Z","database_specific":{"cna_assigner":"GitLab","cwe_ids":["CWE-95"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100741.json"},"references":[{"type":"WEB","url":"https://gitlab.com/Progressiverobot/hmailserver/-/releases/v6.3.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100741.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100741"},{"type":"FIX","url":"https://gitlab.com/Progressiverobot/hmailserver/-/commit/5a3de9001d6c5e833662ada8e44ce10d42d76b1a"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/hmailserver/hmailserver","events":[{"introduced":"e4b7163189ac6ce365bb954cf3e264e2e3105a18"},{"fixed":"51e2dbda08d6aa7fcda5a48f1af05221809f78be"},{"fixed":"5a3de9001d6c5e833662ada8e44ce10d42d76b1a"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"6.0.0"},{"fixed":"6.3.4"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"fixed":"5a3de9001d6c5e833662ada8e44ce10d42d76b1a"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v6.3.3","v6.3.2","build-inputs-1","v6.3.1","v6.3.0","v6.2.28","v6.2.27","v6.2.26","v6.2.25","v6.2.24","v6.2.23-alpha2","v6.2.23-alpha1","v6.2.22-pre6","v6.2.22-pre5","v6.2.22-pre4","v6.2.22-pre3","v6.2.22-pre2","v6.2.22-pre1","v6.2.21","v6.2.20","v6.2.19","v6.2.18","v6.2.17","v6.2.16","v6.2.15","v6.2.14","v6.2.13","v6.2.12","v6.2.11","v6.2.10","v6.2.9","v6.2.8","v6.2.7","v6.2.6","v6.2.5","v6.2.4","v6.2.3","v6.2.2","v6.2.1","v6.2.0","v6.1.0","v6.0.0-B4","v6.0.0-B3","v6.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100741.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["173026644744428468122178710305458733610","72023418976949700636706848348170513083","221755301875929245221851728560244100688","86015716840889777238664922845986602568"],"threshold":0.9},"id":"CVE-2026-100741-03cbf0d8","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/Util/OpenPgpKey.cpp"}},{"deprecated":false,"digest":{"function_hash":"221298502580959622673081158792108986591","length":973},"id":"CVE-2026-100741-160ac7e9","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"function":"BrandLogo::Known","file":"hmailserver/source/Server/Common/Util/BrandLogo.cpp"}},{"deprecated":false,"digest":{"function_hash":"128923565477708758940593015408547466370","length":2150},"id":"CVE-2026-100741-1df6719b","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a","target":{"file":"hmailserver/source/Server/Common/Application/ErrorManager.cpp","function":"ErrorManager::ReportError_"}},{"signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a","target":{"file":"hmailserver/source/Server/Common/Scripting/Events.cpp","function":"Events::FireOnExternalAccountDownload"},"deprecated":false,"digest":{"function_hash":"331635609444975975074704696935829754652","length":1652},"id":"CVE-2026-100741-1f0946dc","signature_type":"Function"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["144971333099417583677465868090583294341","31159591477287234542554676120105802797","187316242465413148142487768211424648896"]},"id":"CVE-2026-100741-25acf673","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/AntiSpam/DMARC/DMARC.cpp"}},{"signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"function":"BrandLogoTester::Test","file":"hmailserver/source/Server/Common/Util/BrandLogo.cpp"},"deprecated":false,"digest":{"function_hash":"186398542115389452270982473998957878288","length":5043},"id":"CVE-2026-100741-2ade12be"},{"source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/Util/BrandLogo.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["168436356617409950203061960813192391513","6794219631689290374375489382766084136","252982190880083623206279529070075974574","299040040893001406502522247329002866547","287776739933185647292506548609677251186","231079773074675756992636741122816628595","202456874104008953527166003454093353990","280163632586104781557342952693406806439","331526745349849731646393559398602458790","243494023290129129247647142079354925171","136050685234224721948291361893832728254","31933306883685020205990209721312268021","121118874047973560113727775030293053838","150404206715707704019842938531875526158","321727766633300175530979160633919537387","135856718981026289583584401003473709918","134844127943263121532631510593039974225","272110326339456724343688205065594121499","51853996588338471719564324329830795455","79537457975022156230197554773554757390","159047340350530216060843677576605554244","11054909884212234558068204007937845336","138198898639824643694516625013774586703","234224701433770972670466770643766770767","301397185273431833290693057306824921022","172773720504601780971733192650514012601","298420838722684324919004038955221678482","112713433705879362159734459973400990002","58725824035969435507292074060043744404","187155979713494877424140503413922900249","43562112869163724717121068670467317579","186181325023914072765685820336622063621","36162853698317664990001524707683579454","130160835077689870641305337167501541080","172303239323519771248590415933409487693","263003904147061727736075762846303040636","328623339914416941917653308980437055009","93184631329294095492664046036972427577","238612367967960963215902181164545442400","130542493997154179637231108077803085067","56551016899255927073418015047294135406","4140569880360836934746170614674767758"]},"id":"CVE-2026-100741-3bfe3d58","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-100741-48019660","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a","target":{"file":"hmailserver/source/Server/Common/Scripting/Events.cpp","function":"Events::FireOnDeliveryFailed"},"deprecated":false,"digest":{"length":1570,"function_hash":"310319588703213628297204907685271355499"}},{"source":"https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a","target":{"file":"hmailserver/source/Server/Common/Scripting/ScriptServer.cpp"},"deprecated":false,"digest":{"line_hashes":["54736881936118555589558946657062301954","229706180944439301771732116542379163491","174414407847498382000071080308127779853","229168194170764373883841146782549492150","98601569559253649160716883419270915539","233779230979790557805985077034284925309","82084196348983213666697620292601882068","274430235164293542590454059444639719087","141705646902593885552709430821529650415"],"threshold":0.9},"id":"CVE-2026-100741-50e4df90","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"function":"DMARC::GetOrganizationalDomain","file":"hmailserver/source/Server/Common/AntiSpam/DMARC/DMARC.cpp"},"deprecated":false,"digest":{"function_hash":"278807372347695046392379528524658391690","length":1491},"id":"CVE-2026-100741-540d43f2"},{"id":"CVE-2026-100741-5aedc00a","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a","target":{"file":"hmailserver/source/Server/Common/Util/ClassTester.cpp","function":"ClassTester::DoTests"},"deprecated":false,"digest":{"length":33109,"function_hash":"188978514926816756569628164524781870217"}},{"signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a","target":{"file":"hmailserver/source/Server/Common/Application/ErrorManager.cpp","function":"ErrorManager::EscapeForScriptLiteral_"},"deprecated":false,"digest":{"function_hash":"281966080051011728174539370975067727778","length":358},"id":"CVE-2026-100741-5e92b1d6"},{"deprecated":false,"digest":{"function_hash":"101049009052070862673143003378209265536","length":2529},"id":"CVE-2026-100741-600a17a1","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/Util/BrandLogo.cpp","function":"BrandLogo::Lookup"}},{"digest":{"length":291,"function_hash":"201216107189199025747155831459028417972"},"id":"CVE-2026-100741-685fb01d","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/Util/OpenPgpRing.cpp","function":"OrganizationOf"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"function":"BrandLogo::NoteUnreachable","file":"hmailserver/source/Server/Common/Util/BrandLogo.cpp"},"deprecated":false,"digest":{"length":355,"function_hash":"123310048572992211037007553603146831106"},"id":"CVE-2026-100741-7ad95dc8"},{"id":"CVE-2026-100741-7b5a34ed","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a","target":{"file":"hmailserver/source/Server/Common/Application/BackupManager.cpp"},"deprecated":false,"digest":{"line_hashes":["106542373993982903543230604757882353669","232196250110594156689439420422749690313","183220730686388094287609818594086984991","236198940078758749668739929570747975194","34624701013936692121560702308961838544"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a","target":{"file":"hmailserver/source/Server/Common/Util/HelpPagesData.cpp"},"deprecated":false,"digest":{"line_hashes":["338715573963286343287474767827236227017","244823307453781921811613512757342559022","84469750297443293998760181763802401571","112316489728264184261874751677275701895","193336097000849899974040375549043079245","16651200450420897554869769241312721239","239300529221871919801485047881267520496","7878502701028849306991325437848116380","49897272061219843746989700225227931975","302842601042940520570921422167684580374","165907117179942306000762870567200518772","149971453418278372951411869274750006094","202670703186588759321138870142824935845","241973761619791918414143273412179633204","128037545091248458351195096774796111916","236112913281880244353062392931862450415","203885134244102568214106785333954036255","205291756924249671200777490872718764520","21773715346609150253438994555764090134","316039707997507475214784447065013306015","189804384264932200349495994266313637401"],"threshold":0.9},"id":"CVE-2026-100741-828e5376"},{"signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a","target":{"file":"hmailserver/source/Server/Common/Application/ErrorManager.cpp"},"deprecated":false,"digest":{"line_hashes":["235068009922122245096147898414527796890","202106208347999268925592517405875427969","212410323386508029321599072476377419926","8699687235561483272917986714755626690","27572851692492310316005505644064616454","30868162295207361792691055685853797228","164839102790152075046176846417164749915","65724994755792004753800618633318034501","192032997600568690392612768127567039470","12742992406361118291249721030484681457","127838980516391427577527551327428176606","323948830972994709904113873473827349745","57608324879848345999591147933579544961","140393602716224035271326317422783533109","110668317227959833320982902346735745874","155277232727133947236394653022051299778","110959077466463243528577149614472231821","172965732375608997302301081235840948294","233413406406677967744629536972060661400","146047042278794520739498090638610757177","162015983949435950377260178721004750611","185694148416676895542366415082009488414","332077676686110490887743121563340614681","172828099241677199888766075062815208211","211008518954599491222561611925596679441","246681204928392871535838691271371047644","237900866802777836041923701971043576038","103619381092571575608774015844001031226","315837747138612504222060109135406842711","337020304475620992958740594743328339692","264917997795488587494918981771097390718","35313025998849292817538963929079217330","211008518954599491222561611925596679441","246681204928392871535838691271371047644","297719828275464945153406459408754272800","174973971600193173322461794377329552806"],"threshold":0.9},"id":"CVE-2026-100741-870e6e3c"},{"digest":{"line_hashes":["235758542281879581439071837042782900296","39854109563317671887276956300757111729","180591959127919996928156142301543362502","267111967522577991641479310576499398938","69453275827299831512192435788517335221","21043194468232056726023629652902425387","336693078245008672052710251389787425132"],"threshold":0.9},"id":"CVE-2026-100741-88219093","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a","target":{"file":"hmailserver/source/Server/Common/Util/ClassTester.cpp"},"deprecated":false},{"target":{"file":"hmailserver/source/Server/Common/Scripting/ScriptServer.h"},"deprecated":false,"digest":{"line_hashes":["205876520467730485614981509545869293398","21764508780791362081414858423125947900","65647469226180869829424521064035847269","238239859876124510733713041366881415818","306728571835279173710560041571424985290"],"threshold":0.9},"id":"CVE-2026-100741-8bdace81","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a"},{"signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a","target":{"file":"hmailserver/source/Server/Common/Application/BackupManager.cpp","function":"BackupManager::OnBackupFailed"},"deprecated":false,"digest":{"length":1121,"function_hash":"222910894375453233701528945680416242832"},"id":"CVE-2026-100741-ac1386ce"},{"deprecated":false,"digest":{"line_hashes":["217382572294579024735186115350336824679","232644099280258314673252833632276642099","110569033486641569700537356008436665845","84119630109514399254486181244345713130","259019608430282499671422980499421477618","52087883268710942835635511936791275282","179030710271600826080624829516933781491","224199370542123069802823027860631327891","200353981174873361365807128097563402385","316390505624589695144811903274316766118","133089887383778879198519001979618554720","54950605529578730242318991905163910731","265855952655961837495456519263390755392","230353888280009246803103428288728273728","76779441353424855381469476030476787557","79012237758407394652907649643996776792","25522713397161463026179222506230686611","64126595560494705544673621272880779613","211058975816949608175577181041279670458","29800085896162780145646767332964607418","301730279402659834591514492834334066072","186630290065603701434527332358208467213","25638580773822852539937310495465095447","259915868232482277532496485102897914632","82250017844024707338911690750149863928","174084133835922313078379776494829066329","2065155735359526455960829967888112969","160514846154226678461703270474070596984","43989780037341512358409362985998826467","284473009188797321148608657203341343862","118098243344204889721369539689993235560","283309733487295571326145247622519034222","331614447821169766920274085995693130986","176657794663911736929009410982039958967","223379499072880358704029102742648425174","336558161408354835180887745069676588330","176679858706659811817064273985023338676","60358499010207033038067530593022014384","274151641384423890508517136232117386476"],"threshold":0.9},"id":"CVE-2026-100741-b3897b18","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/Util/HelpPagesData.cpp"}},{"deprecated":false,"digest":{"length":393,"function_hash":"203823155983048518933070330295708678424"},"id":"CVE-2026-100741-b73bf924","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/Util/BrandLogo.cpp","function":"BrandLogo::OrganizationUnreachable"}},{"signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/Util/OpenPgpRing.h"},"deprecated":false,"digest":{"line_hashes":["13305429830417078381577849579222307952","200963078023762552825019393750614922818","253563660183400374534982320389126141836","234216325056108639265321213186242383847","323502006306225203958453684764698789172","330608554865418440534524197738713451695"],"threshold":0.9},"id":"CVE-2026-100741-b83b53f7","signature_type":"Line"},{"digest":{"line_hashes":["152299132225481955129083943650846430355","6832375023684051416024853616361073248","17286084956157793008968093056903433243","333926647583753214205894131391698095821","182954244113595280749716391894917881052","10858688535906719378376534038702630206","49245178924821749663418407928741492277","198449475183301911312041086383448532849","245747971491445848035082446334526738410","278093215453296294471553309692391210011","22720539698454247105318459248710942846","260309424996080693003755716393366232174","297613183086039466654188872362741305411","83957724610820370361630691803768850830","26495453224653257279366685044481481565","189709503675348466167373995380834859094","10978199679427179090966753870859204368","9154682085417310374767006515767487313","19881229781620602186308276457337437711","324572266610113110387869397512302309116","109922435036688171536546886352730029414","333601900956653395105293064694531168428","238793520418025444556797171875566900645","16155061912276528935849030281324998088","177320160773423319251042524889336844238","73058796500149874001442693826784133305","27018090392347864312123848083753264713","201927254980614350098587277271123287661","303686298033920729976632668539186359104","156433723844260406884997666237948756309","138894064220673407651725242671189798819","125019865211290587116655878065852377973","230824176478718862520099157531290681061","38686542358223295083678148303309426063","270472538301331821370673936795850477138","49836890341310462912134001365840850705","63479588901760399606865205982032770922","163341128980479675061617121035740813469","340167185421461139211499616584089667658","28548489704343060949689971804232349899","5395620120301560644686979954111996102","280224792796370955696431520193322369242","216115057690403493105938423696936861935","293786890815987531955079945967820543629","320761796262881018007117505877699757993","5857276131175026203138028776326389310","135767860110261933709455295171715619804"],"threshold":0.9},"id":"CVE-2026-100741-be0bf4aa","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/Util/OpenPgpRing.cpp"},"deprecated":false},{"source":"https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a","target":{"file":"hmailserver/source/Server/Common/Scripting/ScriptServer.cpp","function":"ScriptServer::FireEvent"},"deprecated":false,"digest":{"function_hash":"69966790253968744245818810918552131457","length":3970},"id":"CVE-2026-100741-bf4ce9dc","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["185457136636630786016387300638476587444","313508833223557017696788960207980164864","1107235692602077839319995840458238301","39660285421076289600162885773794208520","187594608586215307500194312235013694228","18430386238688280566208019113092141915","72069862785867228852786701870890024257","201909523222810530427390132110981369246","178174268358184673851036887732558749305","104214642376183267096625871118126691762","302605622537871218917150777753203180212","2183771615646285003987018217378575415","196675853901054916109552851174915360877","247151911840617762179170503584148311024","263259147706285659474129660642266862551","27584707124496793590657781751139464102","125498288205216845856168511069480281207","207707212446618272237586881059258871317","117835249732406250691455072818160233531","58837913699016000374947067995238259615","242803848709297649809821469941606096200","232186321677285315433934956339205199426"]},"id":"CVE-2026-100741-c1ef3237","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a","target":{"file":"hmailserver/source/Server/Common/Scripting/Events.cpp"}},{"digest":{"function_hash":"16789147279579673751328946408595684874","length":12845},"id":"CVE-2026-100741-d8c252b2","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/Util/OpenPgpKey.cpp","function":"OpenPgpKeyTester::Test"},"deprecated":false},{"signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"file":"hmailserver/source/Server/Common/AntiSpam/DMARC/DMARC.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["149908044363547641126729805970713464697","134579754139239445225456843238923825694","55952527745130178710956086528791140696","119590332145380478806719950532080953389","24012987281392793160008181792258729292","238841215959507221196200319264240349921"]},"id":"CVE-2026-100741-dbadab72","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a","target":{"file":"hmailserver/source/Server/Common/Scripting/Events.cpp","function":"Events::FireOnClientValidatePassword"},"deprecated":false,"digest":{"function_hash":"240001852906492362512370745183547561127","length":1447},"id":"CVE-2026-100741-e01dd8d8"},{"deprecated":false,"digest":{"length":3573,"function_hash":"292573371798982288366075326854979257954"},"id":"CVE-2026-100741-e15fb309","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/hmailserver/hmailserver@51e2dbda08d6aa7fcda5a48f1af05221809f78be","target":{"function":"OpenPgpRing::Lookup","file":"hmailserver/source/Server/Common/Util/OpenPgpRing.cpp"}},{"source":"https://gitlab.com/hmailserver/hmailserver@5a3de9001d6c5e833662ada8e44ce10d42d76b1a","target":{"file":"hmailserver/source/Server/Common/Application/ErrorManager.h"},"deprecated":false,"digest":{"line_hashes":["147925165034629179924120015998028166322","273781196487154512984138194203017809776","162461377725920649803291145149787481155","88581702074200857922836946702888135198"],"threshold":0.9},"id":"CVE-2026-100741-ecc57d41","signature_type":"Line","signature_version":"v1"}],"vanir_signatures_modified":"2026-11-11T13:19:35Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}