CVE-2026-94056

• SECURITY UPDATE: uninitialised stack data use in Proxy Protocol v2
  • debian/patches/CVE-2026-94056.patch: repeat reads until the complete 16-byte PROXY v2 header, including the length field, has been received, and abort if the peer closes before that.
  • CVE-2026-94056

• CVE-2026-94056: repeat the PROXYv2 header read until all 16 octets have arrived, so the length field is never taken from uninitialised memory

• CVE-2026-94056: repeat the PROXYv2 header read until all 16 octets have arrived, so the length field is never taken from uninitialised memory

• CVE-2026-94056: loop until the full 16-octet PROXY protocol v2 header has been read in proxy_protocol_setup(), so a short read cannot leave the header length field uninitialised

• SECURITY UPDATE: out-of-bounds access in Proxy-Protocol v1 header parsing with an attacker-controlled proxy
  • debian/patches/CVE-2026-94054.patch: set ret to the length of the heap copy of the PROXY v1 line instead of adding the swallow_until_crlf() count, so the memchr() for the CR stays inside the copy
  • CVE-2026-94054
• SECURITY UPDATE: uninitialised stack data read on a short Proxy-Protocol v2 header from an attacker-controlled proxy
  • debian/patches/CVE-2026-94056.patch: repeat the read of the v2 length fields until all 16 header octets have arrived, and abort on EOF or error instead of using uninitialised length data
  • CVE-2026-94056

• CVE-2026-94056: read the full Proxy Protocol v2 header before using its length field, avoiding use of uninitialised stack data

Root has patched CVE-2026-94056 in the exim4 package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-94056 in the exim4 package for Root:Debian:13. Multiple fixed versions available.

It was discovered that Exim had an out-of-bounds write when Proxy-Protocol was used with an attacker-controlled proxy. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-94054)

It was discovered that Exim had a use-after-free when certain non-default TLS settings were used with GnuTLS. A remote attacker could possibly use this issue to cause Exim to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-94055)

It was discovered that Exim allowed attackers to read uninitialized data from stack memory when Proxy-Protocol was used with an attacker-controlled proxy. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-94056)

It was discovered that Exim allowed SMTP smuggling via crafted data sent after a rejection during DATA processing. A remote attacker could possibly use this issue to inject arbitrary email messages. (CVE-2026-94057)