{"id":"CVE-2026-40684","aliases":["ALPINE-CVE-2026-40684","CLSA-2026-1778003565","CLSA-2026-1778174719","DEBIAN-CVE-2026-40684","EUVD-2026-26442","GHSA-q496-q274-jgh9"],"status":"published","title":"In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the...","description":"In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00362,"percentile":0.30418,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-684"],"published":"2026-04-30T00:00:00Z","modified":"2026-11-03T06:32:55Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"exim","fixed_in":["4.98.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"exim","fixed_in":["4.98.2-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"exim4","fixed_in":["4.86.2-2ubuntu2.6+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"exim4-base","fixed_in":["4.86.2-2ubuntu2.6+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"exim4-config","fixed_in":["4.86.2-2ubuntu2.6+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"exim4-daemon-heavy","fixed_in":["4.86.2-2ubuntu2.6+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"exim4-daemon-light","fixed_in":["4.86.2-2ubuntu2.6+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"exim4-dev","fixed_in":["4.86.2-2ubuntu2.6+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"eximon4","fixed_in":["4.86.2-2ubuntu2.6+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"exim4","fixed_in":["4.96-15+deb12u9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"exim4","fixed_in":["4.98.2-1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"exim4","fixed_in":["4.99.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-daemon-heavy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-daemon-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"eximon4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.86.2-2ubuntu2.6+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"exim4-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.86.2-2ubuntu2.6+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"exim4-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.86.2-2ubuntu2.6+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"exim4-daemon-heavy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.86.2-2ubuntu2.6+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"exim4-daemon-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.86.2-2ubuntu2.6+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"exim4-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.86.2-2ubuntu2.6+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"eximon4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.86.2-2ubuntu2.6+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.96-15+deb12u9"}]}],"versions":["4.96-15","4.96-15+deb12u1","4.96-15+deb12u2","4.96-15+deb12u3","4.96-15+deb12u4","4.96-15+deb12u5","4.96-15+deb12u6","4.96-15+deb12u7","4.96-15+deb12u8"]},{"source":"osv","ecosystem":"Debian:13","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-1+deb13u2"}]}],"versions":["4.98.2-1","4.98.2-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.2-1"}]}],"versions":["4.98.2-1","4.98.2-1+hurd.1","4.98.2-2","4.99-1","4.99-2","4.99-3","4.99-4","4.99-4~bpo13+1","4.99-5","4.99-6","4.99-6~bpo13+1","4.99-7","4.99-7~bpo13+1","4.99.1-1","4.99.1-1~bpo13+1","4.99.1-2","4.99.1-3","4.99.1-4","4.99.1-5","4.99.1-6","4.99.2-1~bpo13+1","4.99~RC1-1","4.99~RC2-1","4.99~RC3-1","4.99~RC3-2"]}],"products":[{"vendor":"exim","product":"exim"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2026/04/30/21","tags":["Mailing List","Third Party Advisory"]},{"url":"https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40684.assessment","tags":["Vendor Advisory"]},{"url":"https://code.exim.org/exim/exim/commit/628bbaca7672748d941a12e7cd5f0122a4e18c81","tags":["Patch"]},{"url":"https://exim.org/static/doc/security/CVE-2026-40684.txt","tags":["Broken Link"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/01/11"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40684"},{"url":"https://exim.org/static/doc/security/CVE-2025-40684.txt"},{"url":"https://github.com/advisories/GHSA-q496-q274-jgh9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-40684","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1778003565.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1778174719.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-40684","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-40684","description":"In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.","status":"published","published":"2026-04-30T00:00:00Z","modified":"2026-05-01T17:22:32.062Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-684"],"updated_at":"2026-11-02T13:43:11.445168Z"}],"euvd":[{"id":"EUVD-2026-26442","description":"In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.","status":"published","published":"2026-04-30T00:00:00Z","modified":"2026-05-01T17:22:32Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:05:18.723006Z"}],"ghsa":[{"id":"GHSA-q496-q274-jgh9","title":"In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the...","description":"In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.","status":"published","published":"2026-05-01T00:31:27Z","modified":"2026-05-01T18:32:31Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-684"],"updated_at":"2026-11-02T15:07:52.84276Z"}],"nvd":[{"id":"CVE-2026-40684","description":"In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.","status":"published","published":"2026-04-30T22:16:25.477Z","modified":"2026-11-11T21:10:00.2Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-684"],"updated_at":"2026-11-11T23:26:36.997374Z"}],"osv":[{"id":"ALPINE-CVE-2026-40684","description":"In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.","status":"published","published":"2026-04-30T22:16:25.477Z","modified":"2026-11-03T06:32:55.452306453Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"DEBIAN-CVE-2026-40684","description":"In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.","status":"published","published":"2026-04-30T22:16:25.477Z","modified":"2026-10-01T03:03:04.751269168Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"CLSA-2026-1778003565","title":"Fix CVE(s): CVE-2026-40684, CVE-2026-40685, CVE-2026-40687","description":"   * SECURITY UPDATE: out-of-bounds read in DNS reverse-lookup escape\n     decoding when running against musl libc\n     - debian/patches/CVE-2026-40684.patch: harden string_copy_dnsdomain()\n       to consume 1, 2, or 3 digits incrementally instead of indexing past\n       the input string when fewer than 3 digits follow a backslash escape\n     - CVE-2026-40684\n   * SECURITY UPDATE: out-of-bounds heap write in JSON dewrap on malformed\n     header value ending in a trailing backslash\n     - debian/patches/CVE-2026-40685.patch: only skip a backslash in\n       dewrap() when followed by a non-NUL character\n     - CVE-2026-40685\n   * SECURITY UPDATE: SPA authenticator out-of-bounds write and\n     uninitialised-heap information disclosure\n     - debian/patches/CVE-2026-40687.patch: zero the spa_base64_to_bits()\n       output buffer to plug the infoleak; replace assert()-based length\n       guards in unicodeToString(), strToUnicode(), and toString() with\n       explicit length clamping to prevent OOB writes\n     - CVE-2026-40687","status":"published","published":"2026-05-05T17:52:50Z","modified":"2026-06-04T10:03:58.992093Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778174719","title":"Fix CVE(s): CVE-2026-40684","description":"   * SECURITY UPDATE: Crash via malformed DNS response on musl libc systems\n     - debian/patches/CVE-2026-40684.patch: handle musl libc dn_expand\n       backslash-decimal escape oddity in string_copy_dnsdomain\n     - CVE-2026-40684","status":"published","published":"2026-05-08T07:11:17Z","modified":"2026-06-04T10:04:09.323871Z","updated_at":"2026-11-02T15:43:44.737408Z"}]}}