CVE-2026-94054

• CVE-2026-94054: fix out-of-bounds read in Proxy Protocol v1 header parsing
• CVE-2026-94057: avoid more SMTP smuggling attack types by honouring strict CRLF mode when swallowing input after a data-phase rejection

• CVE-2026-94054: in proxy_protocol_setup(), size the copy of the PROXY v1 header line by its own NUL-terminated length instead of the raw byte count read from the socket, so the following memchr() cannot read past the allocation and the CR terminator cannot be written outside it

• CVE-2026-94054: in proxy_protocol_setup(), size the copy of the PROXY v1 header line by its own NUL-terminated length instead of the raw byte count read from the socket, so the following memchr() cannot read past the allocation and the CR terminator cannot be written outside it

• SECURITY UPDATE: uninitialised stack data use in Proxy Protocol v2
  • debian/patches/CVE-2026-94056.patch: repeat reads until the complete 16-byte PROXY v2 header, including the length field, has been received, and abort if the peer closes before that.
  • CVE-2026-94056

• CVE-2026-94054: recompute the PROXY protocol v1 header length from the copied line in proxy_protocol_host(), so the following memchr() and end-of-line store cannot read or write past the allocation
• CVE-2026-94057: make read_message_data_smtp() honour the strict-CRLF state of the current message when receive_swallow_smtp() drains input after a DATA rejection, preventing further SMTP smuggling variants

• CVE-2026-94054: fix out-of-bounds read and write in the PROXY protocol v1 header parser

• SECURITY UPDATE: out-of-bounds access in Proxy-Protocol v1 header parsing with an attacker-controlled proxy
  • debian/patches/CVE-2026-94054.patch: set ret to the length of the heap copy of the PROXY v1 line instead of adding the swallow_until_crlf() count, so the memchr() for the CR stays inside the copy
  • CVE-2026-94054
• SECURITY UPDATE: uninitialised stack data read on a short Proxy-Protocol v2 header from an attacker-controlled proxy
  • debian/patches/CVE-2026-94056.patch: repeat the read of the v2 length fields until all 16 header octets have arrived, and abort on EOF or error instead of using uninitialised length data
  • CVE-2026-94056

Root has patched CVE-2026-94054 in the exim4 package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-94054 in the exim4 package for Root:Debian:13. Multiple fixed versions available.

It was discovered that Exim had an out-of-bounds write when Proxy-Protocol was used with an attacker-controlled proxy. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-94054)

It was discovered that Exim had a use-after-free when certain non-default TLS settings were used with GnuTLS. A remote attacker could possibly use this issue to cause Exim to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-94055)

It was discovered that Exim allowed attackers to read uninitialized data from stack memory when Proxy-Protocol was used with an attacker-controlled proxy. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-94056)

It was discovered that Exim allowed SMTP smuggling via crafted data sent after a rejection during DATA processing. A remote attacker could possibly use this issue to inject arbitrary email messages. (CVE-2026-94057)