# CipherMail Gateway 6.5.0 released **URL:** \ **Category:** General\ **Created:** [October 16, 2026, 11:50am UTC](https://community.ciphermail.com/t/ciphermail-gateway-6-5-0-released/1067 "2026-10-16T11:50:20Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![martijn](https://dub1.discourse-cdn.com/flex017/user_avatar/community.ciphermail.com/martijn/32/127_2.png) [@martijn](https://community.ciphermail.com/u/martijn)\ **Post date:** [October 16, 2026, 11:50am UTC](https://community.ciphermail.com/t/ciphermail-gateway-6-5-0-released/1067/1 "2026-10-16T11:50:20Z")
Today we are releasing CipherMail Email Encryption Gateway 6.5.0. This is a security hardening release. Nothing in it changes the cryptography; the work went into everything around it: sign-in, sessions, the admin IP restrictions, OpenID Connect, header handling, uploads and Webmail Messenger. Most of the changes are invisible when everything is set up as documented, but a few need a look before you upgrade (see below). ## Highlights **Sign-in and passwords** - Failed sign-ins are limited per client address, whatever the user (default 300 in 600 seconds, configurable, 0 switches it off). Only a wrong password counts. - The number of password checks running at the same time is bounded (default 8), so a flood of sign-ins can no longer exhaust the heap. A sign-in which finds no free slot is refused and not counted. - The 5-failures-per-user limit is checked and counted in one step, so parallel requests cannot try more passwords. It now also applies to LDAP admins and LDAP Company Portal users. An outage of the back-end or the LDAP server no longer counts as a failure. - An unknown portal or Company Portal user gets the same slow answer as a wrong password. - Signup, password reset and PDF reply links, the system mail HMAC header and TOTP codes are compared in constant time. - A new admin password must be at least 12 characters and follow the portal rules; a password with the system encoding (machine accounts) at least 32. Alphabetical sequences (`abcde`) are refused like keyboard sequences already were. Existing passwords are not affected. **Admin access** - The IP addresses an admin is restricted to are checked on every request. A session ends when a request comes from an address that is not on the list. - Only the loopback address may set `X-Forwarded-For`. Behind a trusted proxy, a client with a private address could claim any address. - The permission of a property is checked before its user or domain is looked up, so an admin without the permission can no longer enumerate users and domains. **OpenID Connect and Entra ID** - A login is refused when the provider says the email address is not verified. On by default for the Company Portal, off for the admin. - An Entra ID login to the Company Portal requires that Entra ID verified the domain of the email address (`xms_edov` claim). - The administration guide now finds Entra ID admins by object ID (`oid`), and the bug that broke a login on an ID-token-only claim is fixed. **Mail processing** - The subject filter is applied to the protected subject of a PGP/MIME or S/MIME message, so a sender can no longer add a tag such as `[signed]` through the protected header. - At most 10 signers of an S/MIME message are checked, and a signer whose signature does not verify is not trust-checked. - A line break hidden in an encoded word can no longer be used to inject headers; it becomes a space. - No PDF password and no portal signup is created for a recipient address that is not valid for the gateway (goodbye `invalid@invalid.tld`). **Portals and Webmail Messenger** - Uploads are not read before the login, and are limited: 50 MB portal, 1 MB Company Portal, 100 MB admin, 5 MB portal forms (configurable). - Only images with a `cid:` or `data:` address are shown. A relative address could be used to mark another message as read and send its read receipt. - A message is marked read, and its read receipt sent, by an explicit request after it is displayed, not when its body is fetched. - A portal user can send 10 Webmail messages per minute and 200 per day (configurable). - Failed PDF replies count against the reply limit of the link. **Other changes** - `security.txt` (RFC 9116) can be served from `/.well-known/security.txt` (`ciphermail_ui__security_txt`). - The default Content Security Policy gains `frame-ancestors 'self'`, `base-uri 'self'` and `object-src 'none'`. - `ciphermail_ui__ssl_signature_algorithms` sets the TLS signature algorithms, for example to stop SHA-1 under the `LEGACY` crypto policy. - Cockpit can be bound to an address, and `ciphermail_ui__additional_config` adds httpd configuration for every web UI (with an Azure Front Door example in the guide). The playbook runs `httpd -t` before replacing the running configuration. - UI: input labels are linked to their fields for screen readers, many translations fixed, sidebar logo size and alt text are brandable, clicking the active menu item reloads the page. ## Read this before upgrading - **Re-check the admin IP address lists.** `10.1.2.5/24` is now the whole /24, an IPv6 address is one host and no longer its /64, and an empty entry or a bare prefix length is refused. An admin whose list holds only empty entries cannot sign in until it is fixed (`auth admin ip-addresses clear` with the local `cli` admin). - **X-Forwarded-For is trusted from loopback only.** If your web server connects to a back-end from another address, extend `ciphermail_*__remoteip_internal_proxies`, and remove any `server.tomcat.remoteip.internal-proxies` entry from `*__user_defined_system_properties`. - **Company Portal with OpenID Connect:** logins with an unverified email address are refused by default. A Keycloak with LDAP-federated or brokered users marks every address unverified unless “Trust Email” is on. With Entra ID, add the optional claims `email` and `xms_edov` to the ID token, or every login is refused. - **Webmail REST clients of your own:** `GET /api/webmail/getBodyAndAttachments` no longer marks the message as read. Call `POST /api/webmail/messageDisplayed` after showing it. - **The web UI bind addresses must be IP addresses.** httpd now listens only on the configured address and does not start when a host name does not resolve to the machine. - `ciphermail_backend __remote_pdf_otp_header` and `ciphermail_backend__ remote_webmail_header` must be plain header names, or the gateway does not process mail. - An override of `ciphermail_ui__csp` should add the new directives itself. - `/api/user/getUser` (CLI `user get`) answers 404 for an unknown user instead of an empty 200. Use `isUser` (`user check`) to test for existence. - Permissions that could never be used (portal password, 2FA or OTP secret at domain or global level) are removed. Existing roles keep working; setting a list that contains one is refused. Full details: [Email Encryption Gateway release notes - CipherMail Email Encryption](https://www.ciphermail.com/gateway-release-notes.html)