Every CVE Search/ Get API key

CVE-2026-40684

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the...

5.9 MediumFix available

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.36%Up 0.3 points since May 1, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.9

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.

Record
CVE-2026-40684
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-684
Updated
2026-11-02
EUVDEUVD-2026-26442 5.9

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.

Record
EUVD-2026-26442
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-q496-q274-jgh9 5.9

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the...

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.

Record
GHSA-q496-q274-jgh9
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-684
Updated
2026-11-02
NVD 5.9

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.

Record
CVE-2026-40684
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-684
Updated
2026-11-02
OSVALPINE-CVE-2026-40684 7.5

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.

Record
ALPINE-CVE-2026-40684
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVDEBIAN-CVE-2026-40684 7.5

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.

Record
DEBIAN-CVE-2026-40684
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1778003565 No score

Fix CVE(s): CVE-2026-40684, CVE-2026-40685, CVE-2026-40687

  • SECURITY UPDATE: out-of-bounds read in DNS reverse-lookup escape decoding when running against musl libc
    • debian/patches/CVE-2026-40684.patch: harden string_copy_dnsdomain() to consume 1, 2, or 3 digits incrementally instead of indexing past the input string when fewer than 3 digits follow a backslash escape
    • CVE-2026-40684
  • SECURITY UPDATE: out-of-bounds heap write in JSON dewrap on malformed header value ending in a trailing backslash
    • debian/patches/CVE-2026-40685.patch: only skip a backslash in dewrap() when followed by a non-NUL character
    • CVE-2026-40685
  • SECURITY UPDATE: SPA authenticator out-of-bounds write and uninitialised-heap information disclosure
    • debian/patches/CVE-2026-40687.patch: zero the spa_base64_to_bits() output buffer to plug the infoleak; replace assert()-based length guards in unicodeToString(), strToUnicode(), and toString() with explicit length clamping to prevent OOB writes
    • CVE-2026-40687
Record
CLSA-2026-1778003565
Updated
2026-11-02
OSVCLSA-2026-1778174719 No score

Fix CVE(s): CVE-2026-40684

  • SECURITY UPDATE: Crash via malformed DNS response on musl libc systems
    • debian/patches/CVE-2026-40684.patch: handle musl libc dn_expand backslash-decimal escape oddity in string_copy_dnsdomain
    • CVE-2026-40684
Record
CLSA-2026-1778174719
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
exim
Alpine:v3.23
 before 4.98.2-r0
4.98.2-r0
exim
Alpine:v3.24
 before 4.98.2-r0
4.98.2-r0
exim4
TuxCare:Ubuntu:20.04
 before 4.93-13ubuntu1.12+tuxcare.els1
4.93-13ubuntu1.12+tuxcare.els1
exim4-base
TuxCare:Ubuntu:20.04
 before 4.93-13ubuntu1.12+tuxcare.els1
4.93-13ubuntu1.12+tuxcare.els1
exim4-config
TuxCare:Ubuntu:20.04
 before 4.93-13ubuntu1.12+tuxcare.els1
4.93-13ubuntu1.12+tuxcare.els1
exim4-daemon-heavy
TuxCare:Ubuntu:20.04
 before 4.93-13ubuntu1.12+tuxcare.els1
4.93-13ubuntu1.12+tuxcare.els1
exim4-daemon-light
TuxCare:Ubuntu:20.04
 before 4.93-13ubuntu1.12+tuxcare.els1
4.93-13ubuntu1.12+tuxcare.els1
exim4-dev
TuxCare:Ubuntu:20.04
 before 4.93-13ubuntu1.12+tuxcare.els1
4.93-13ubuntu1.12+tuxcare.els1
eximon4
TuxCare:Ubuntu:20.04
 before 4.93-13ubuntu1.12+tuxcare.els1
4.93-13ubuntu1.12+tuxcare.els1
exim4
TuxCare:Ubuntu:16.04
 before 4.86.2-2ubuntu2.6+tuxcare.els8
4.86.2-2ubuntu2.6+tuxcare.els8
Show 9 moreShow less
Affected packages
PackageAffectedFixed
exim4-base
TuxCare:Ubuntu:16.04
 before 4.86.2-2ubuntu2.6+tuxcare.els8
4.86.2-2ubuntu2.6+tuxcare.els8
exim4-config
TuxCare:Ubuntu:16.04
 before 4.86.2-2ubuntu2.6+tuxcare.els8
4.86.2-2ubuntu2.6+tuxcare.els8
exim4-daemon-heavy
TuxCare:Ubuntu:16.04
 before 4.86.2-2ubuntu2.6+tuxcare.els8
4.86.2-2ubuntu2.6+tuxcare.els8
exim4-daemon-light
TuxCare:Ubuntu:16.04
 before 4.86.2-2ubuntu2.6+tuxcare.els8
4.86.2-2ubuntu2.6+tuxcare.els8
exim4-dev
TuxCare:Ubuntu:16.04
 before 4.86.2-2ubuntu2.6+tuxcare.els8
4.86.2-2ubuntu2.6+tuxcare.els8
eximon4
TuxCare:Ubuntu:16.04
 before 4.86.2-2ubuntu2.6+tuxcare.els8
4.86.2-2ubuntu2.6+tuxcare.els8
exim4
Debian:12
 before 4.96-15+deb12u9, plus listed versions
4.96-154.96-15+deb12u14.96-15+deb12u24.96-15+deb12u34.96-15+deb12u4
Show 4 moreShow less
4.96-15+deb12u54.96-15+deb12u64.96-15+deb12u74.96-15+deb12u8
4.96-15+deb12u9
exim4
Debian:13
 before 4.98.2-1+deb13u2, plus listed versions
4.98.2-14.98.2-1+deb13u1
4.98.2-1+deb13u2
exim4
Debian:14
 before 4.99.2-1, plus listed versions
4.98.2-14.98.2-1+hurd.14.98.2-24.99-14.99-2
Show 20 moreShow less
4.99-34.99-44.99-4~bpo13+14.99-54.99-64.99-6~bpo13+14.99-74.99-7~bpo13+14.99.1-14.99.1-1~bpo13+14.99.1-24.99.1-34.99.1-44.99.1-54.99.1-64.99.2-1~bpo13+14.99~RC1-14.99~RC2-14.99~RC3-14.99~RC3-2
4.99.2-1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-40684 is a medium vulnerability (CVSS 5.9) in Exim, published April 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in exim 4.98.2-r0.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open