---
title: "hMailServer 6.2.15: IMAP sequence sets, and a restore that could empty the data directory"
url: https://www.hmailserver.co.uk/topic/28207/hmailserver-6.2.15-imap-sequence-sets-and-a-restore-that-could-empty-the-data-directory
author: "Progressiverobot"
published: 2026-08-11T23:06:28.000Z
updated: 2026-08-11T23:06:28.000Z
category: "Announcements & releases"
tags: ["release","bugfix","imap","smtp","control-panel"]
site: hMailServer Community Forum
---

# hMailServer 6.2.15: IMAP sequence sets, and a restore that could empty the data directory

The IMAP sequence-set parsers only recognised `*` as the end of a range. Anywhere else it was parsed as zero, so `UID STORE *:* +FLAGS (\Deleted)` flagged every message in the mailbox, `UID EXPUNGE *` deleted every `\Deleted` message, and `FETCH *` returned nothing while answering OK. Any client using `*` outside a range was affected.

**What the upgrade involved**

No database change. The schema stays at version 6005. Issue #18 is not fixed and remains open, see #20.

All four sequence-set parsers now resolve `*` on either side of a colon and normalise descending ranges, so `3:1` is the same set as `1:3`, per RFC 3501. Twelve regression tests cover it, all twelve failing against 6.2.14.

Also fixed:

- Restoring messages emptied the live data directory before checking the backup's message store existed. A settings-only backup restored with the messages option ticked, or a failed extraction, left an empty data directory and the only copy of the mail in a GUID-named temporary folder. It now checks first.
- A message whose file could not be read hung the outbound connection after the remote answered 354, idle until the client timeout of up to ten minutes, then re-queued and repeated. It now fails immediately. Only a genuinely missing file fails the delivery permanently.
- BDAT exact-length reads padded short chunks with NUL bytes. A sender announcing `BDAT 100000 LAST` that vanished after 40,000 octets had the truncated message delivered as complete.
- DKIM signing hashed the header name in lower case while writing it capitalised (upstream PR 530), so signatures using simple canonicalization failed strict verifiers.
- Several paths left files with no database row: rejected POP3 RETR, header rewrites leaving `.eml.tmp`, downloads with no local recipient, unsendable bounces. The account cache had no size cap.
- ManageSieve now disconnects after three failed authentication attempts and registers them with auto-ban. `STATUS (RECENT)` reported the selected folder's count for every folder.
- Settings configurable only in hMailServer.ini gained Control Panel pages: authentication, administrative access, DNS resolver, web services and autoconfiguration, and the consistency scan results.

[Full release notes, checksums and signatures](https://www.progressiverobot.com/hmailserver-downloads/)