{"id":"CVE-2026-40685","aliases":["ALPINE-CVE-2026-40685","CLSA-2026-1778003565","CLSA-2026-1778147239","CLSA-2026-1778147777","CLSA-2026-1778173472","CLSA-2026-1778297730","CLSA-2026-1778690104","DEBIAN-CVE-2026-40685","EUVD-2026-26443","GHSA-pph6-fvmv-fjrc","UBUNTU-CVE-2026-40685","USN-8228-1","USN-8382-1"],"status":"published","title":"In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a...","description":"In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \\ skipping.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00321,"percentile":0.25417,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-684","CWE-787"],"published":"2026-04-29T12:00:00Z","modified":"2026-11-03T06:33:02Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"exim","fixed_in":["4.98.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"exim","fixed_in":["4.98.2-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"exim","fixed_in":["4.92.3-3.el6.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"exim-greylist","fixed_in":["4.92.3-3.el6.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"exim-mon","fixed_in":["4.92.3-3.el6.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"exim-mysql","fixed_in":["4.92.3-3.el6.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"exim-pgsql","fixed_in":["4.92.3-3.el6.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"exim","fixed_in":["4.92.3-3.el6.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"exim-greylist","fixed_in":["4.92.3-3.el6.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"exim-mon","fixed_in":["4.92.3-3.el6.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"exim-mysql","fixed_in":["4.92.3-3.el6.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"exim-pgsql","fixed_in":["4.92.3-3.el6.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim","fixed_in":["4.99.1-1.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-greylist","fixed_in":["4.99.1-1.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-mon","fixed_in":["4.99.1-1.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-mysql","fixed_in":["4.99.1-1.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-pgsql","fixed_in":["4.99.1-1.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"exim4","fixed_in":["4.96-15+deb12u9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"exim4","fixed_in":["4.98.2-1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"exim4","fixed_in":["4.99.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exim4","fixed_in":["4.93-13ubuntu1.12+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"exim4","fixed_in":["4.95-4ubuntu2.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"exim4","fixed_in":["4.97-4ubuntu4.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"exim4","fixed_in":["4.98.2-1ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"exim4","fixed_in":["4.99.1-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-daemon-heavy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-daemon-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"eximon4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.96-15+deb12u9"}]}],"versions":["4.96-15","4.96-15+deb12u1","4.96-15+deb12u2","4.96-15+deb12u3","4.96-15+deb12u4","4.96-15+deb12u5","4.96-15+deb12u6","4.96-15+deb12u7","4.96-15+deb12u8"]},{"source":"osv","ecosystem":"Debian:13","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-1+deb13u2"}]}],"versions":["4.98.2-1","4.98.2-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.2-1"}]}],"versions":["4.98.2-1","4.98.2-1+hurd.1","4.98.2-2","4.99-1","4.99-2","4.99-3","4.99-4","4.99-4~bpo13+1","4.99-5","4.99-6","4.99-6~bpo13+1","4.99-7","4.99-7~bpo13+1","4.99.1-1","4.99.1-1~bpo13+1","4.99.1-2","4.99.1-3","4.99.1-4","4.99.1-5","4.99.1-6","4.99.2-1~bpo13+1","4.99~RC1-1","4.99~RC2-1","4.99~RC3-1","4.99~RC3-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.80-7ubuntu3","4.80-7ubuntu4","4.80-9ubuntu1","4.80-9ubuntu2","4.82-3ubuntu1","4.82-3ubuntu2","4.82-3ubuntu2.1","4.82-3ubuntu2.2","4.82-3ubuntu2.3","4.82-3ubuntu2.4","4.82-3ubuntu2.4+esm1","4.82-3ubuntu2.4+esm2","4.82-3ubuntu2.4+esm3","4.82-3ubuntu2.4+esm4","4.82-3ubuntu2.4+esm6","4.82-3ubuntu2.4+esm7","4.82-3ubuntu2.4+esm8","4.82-3ubuntu2.4+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.86-3ubuntu1","4.86-7ubuntu1","4.86-7ubuntu2","4.86-7ubuntu3","4.86.2-2ubuntu1","4.86.2-2ubuntu2","4.86.2-2ubuntu2.1","4.86.2-2ubuntu2.2","4.86.2-2ubuntu2.3","4.86.2-2ubuntu2.4","4.86.2-2ubuntu2.5","4.86.2-2ubuntu2.6","4.86.2-2ubuntu2.6+esm1","4.86.2-2ubuntu2.6+esm2","4.86.2-2ubuntu2.6+esm4","4.86.2-2ubuntu2.6+esm5","4.86.2-2ubuntu2.6+esm6","4.86.2-2ubuntu2.6+esm7","4.86.2-2ubuntu2.6+esm8","4.86.2-2ubuntu2.6+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.89-5ubuntu1","4.89-9ubuntu1","4.89-9ubuntu2","4.89-9ubuntu3","4.89-9ubuntu4","4.90.1-1ubuntu1","4.90.1-1ubuntu1.1","4.90.1-1ubuntu1.2","4.90.1-1ubuntu1.3","4.90.1-1ubuntu1.4","4.90.1-1ubuntu1.5","4.90.1-1ubuntu1.8","4.90.1-1ubuntu1.9","4.90.1-1ubuntu1.10","4.90.1-1ubuntu1.10+esm1","4.90.1-1ubuntu1.10+esm2","4.90.1-1ubuntu1.10+esm3","4.90.1-1ubuntu1.10+esm4","4.90.1-1ubuntu1.10+esm5","4.90.1-1ubuntu1.10+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+esm1"}]}],"versions":["4.92.1-1ubuntu3","4.92.1-1ubuntu4","4.93~RC2-1ubuntu1","4.93-9ubuntu1","4.93-11ubuntu1","4.93-12ubuntu1","4.93-13ubuntu1","4.93-13ubuntu1.1","4.93-13ubuntu1.5","4.93-13ubuntu1.6","4.93-13ubuntu1.7","4.93-13ubuntu1.8","4.93-13ubuntu1.9","4.93-13ubuntu1.10","4.93-13ubuntu1.11","4.93-13ubuntu1.12"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.95-4ubuntu2.7"}]}],"versions":["4.94.2-7ubuntu2","4.95-2ubuntu2","4.95-4ubuntu1","4.95-4ubuntu2","4.95-4ubuntu2.1","4.95-4ubuntu2.2","4.95-4ubuntu2.3","4.95-4ubuntu2.4","4.95-4ubuntu2.5","4.95-4ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97-4ubuntu4.4"}]}],"versions":["4.96-17ubuntu2","4.96-17ubuntu2.1","4.97-3ubuntu1","4.97-4ubuntu1","4.97-4ubuntu3","4.97-4ubuntu4","4.97-4ubuntu4.1","4.97-4ubuntu4.2","4.97-4ubuntu4.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-1ubuntu2.1"}]}],"versions":["4.98.1-1ubuntu2","4.98.2-1ubuntu1","4.98.2-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1ubuntu1.1"}]}],"versions":["4.98.2-1ubuntu2","4.99-4ubuntu1","4.99.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.95-4ubuntu2.7"}]}],"versions":["4.94.2-7ubuntu2","4.95-2ubuntu2","4.95-4ubuntu1","4.95-4ubuntu2","4.95-4ubuntu2.1","4.95-4ubuntu2.2","4.95-4ubuntu2.3","4.95-4ubuntu2.4","4.95-4ubuntu2.5","4.95-4ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97-4ubuntu4.4"}]}],"versions":["4.96-17ubuntu2","4.96-17ubuntu2.1","4.97-3ubuntu1","4.97-4ubuntu1","4.97-4ubuntu3","4.97-4ubuntu4","4.97-4ubuntu4.1","4.97-4ubuntu4.2","4.97-4ubuntu4.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-1ubuntu2.1"}]}],"versions":["4.98.1-1ubuntu2","4.98.2-1ubuntu1","4.98.2-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1ubuntu1.1"}]}],"versions":["4.98.2-1ubuntu2","4.99-4ubuntu1","4.99.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.82-3ubuntu2.4+esm9"}]}],"versions":["4.80-7ubuntu3","4.80-7ubuntu4","4.80-9ubuntu1","4.80-9ubuntu2","4.82-3ubuntu1","4.82-3ubuntu2","4.82-3ubuntu2.1","4.82-3ubuntu2.2","4.82-3ubuntu2.3","4.82-3ubuntu2.4","4.82-3ubuntu2.4+esm1","4.82-3ubuntu2.4+esm2","4.82-3ubuntu2.4+esm3","4.82-3ubuntu2.4+esm4","4.82-3ubuntu2.4+esm6","4.82-3ubuntu2.4+esm7","4.82-3ubuntu2.4+esm8"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.86.2-2ubuntu2.6+esm9"}]}],"versions":["4.86-3ubuntu1","4.86-7ubuntu1","4.86-7ubuntu2","4.86-7ubuntu3","4.86.2-2ubuntu1","4.86.2-2ubuntu2","4.86.2-2ubuntu2.1","4.86.2-2ubuntu2.2","4.86.2-2ubuntu2.3","4.86.2-2ubuntu2.4","4.86.2-2ubuntu2.5","4.86.2-2ubuntu2.6","4.86.2-2ubuntu2.6+esm1","4.86.2-2ubuntu2.6+esm2","4.86.2-2ubuntu2.6+esm4","4.86.2-2ubuntu2.6+esm5","4.86.2-2ubuntu2.6+esm6","4.86.2-2ubuntu2.6+esm7","4.86.2-2ubuntu2.6+esm8"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+esm6"}]}],"versions":["4.89-5ubuntu1","4.89-9ubuntu1","4.89-9ubuntu2","4.89-9ubuntu3","4.89-9ubuntu4","4.90.1-1ubuntu1","4.90.1-1ubuntu1.1","4.90.1-1ubuntu1.2","4.90.1-1ubuntu1.3","4.90.1-1ubuntu1.4","4.90.1-1ubuntu1.5","4.90.1-1ubuntu1.8","4.90.1-1ubuntu1.9","4.90.1-1ubuntu1.10","4.90.1-1ubuntu1.10+esm1","4.90.1-1ubuntu1.10+esm2","4.90.1-1ubuntu1.10+esm3","4.90.1-1ubuntu1.10+esm4","4.90.1-1ubuntu1.10+esm5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+esm1"}]}],"versions":["4.92.1-1ubuntu3","4.92.1-1ubuntu4","4.93~RC2-1ubuntu1","4.93-9ubuntu1","4.93-11ubuntu1","4.93-12ubuntu1","4.93-13ubuntu1","4.93-13ubuntu1.1","4.93-13ubuntu1.5","4.93-13ubuntu1.6","4.93-13ubuntu1.7","4.93-13ubuntu1.8","4.93-13ubuntu1.9","4.93-13ubuntu1.10","4.93-13ubuntu1.11","4.93-13ubuntu1.12"],"bundled":6}],"products":[{"vendor":"exim","product":"exim"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2026/04/30/21","tags":["Mailing List","Third Party Advisory"]},{"url":"https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40685.assessment","tags":["Vendor Advisory"]},{"url":"https://code.exim.org/exim/exim/commit/9fdc057e71b87c87a0d3d2288b2810a0efaaba57","tags":["Patch"]},{"url":"https://exim.org/static/doc/security/CVE-2026-40685.txt","tags":["Broken Link"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40685"},{"url":"https://exim.org/static/doc/security/CVE-2025-40685.txt"},{"url":"https://github.com/advisories/GHSA-pph6-fvmv-fjrc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-40685","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1778003565.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1778147239.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1778147777.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1778173472.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778297730.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1778690104.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-40685","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-40685","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40685","tags":["report"]},{"url":"https://lists.exim.org/lurker/message/20260429.121733.f58d9686.en.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8228-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8382-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-40686","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-51766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-48840","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-40685","description":"In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \\ skipping.","status":"published","published":"2026-04-30T00:00:00Z","modified":"2026-05-01T14:26:41.873Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-684"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-26443","description":"In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \\ skipping.","status":"published","published":"2026-04-30T00:00:00Z","modified":"2026-05-01T14:26:41Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T19:05:18.723006Z"}],"ghsa":[{"id":"GHSA-pph6-fvmv-fjrc","title":"In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a...","description":"In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \\ skipping.","status":"published","published":"2026-05-01T00:31:27Z","modified":"2026-05-01T18:32:31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-684","CWE-787"],"updated_at":"2026-11-02T15:07:52.84276Z"}],"nvd":[{"id":"CVE-2026-40685","description":"In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \\ skipping.","status":"published","published":"2026-04-30T22:16:25.633Z","modified":"2026-11-11T21:10:00.2Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-684","CWE-787"],"updated_at":"2026-11-11T23:26:36.997374Z"}],"osv":[{"id":"ALPINE-CVE-2026-40685","description":"In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \\ skipping.","status":"published","published":"2026-04-30T22:16:25.633Z","modified":"2026-11-03T06:33:02.705843041Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"DEBIAN-CVE-2026-40685","description":"In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \\ skipping.","status":"published","published":"2026-04-30T22:16:25.633Z","modified":"2026-10-01T03:03:04.753442093Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"UBUNTU-CVE-2026-40685","description":"In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \\ skipping.","status":"published","published":"2026-04-29T12:00:00Z","modified":"2026-06-04T02:14:19.106506719Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"CLSA-2026-1778003565","title":"Fix CVE(s): CVE-2026-40684, CVE-2026-40685, CVE-2026-40687","description":"   * SECURITY UPDATE: out-of-bounds read in DNS reverse-lookup escape\n     decoding when running against musl libc\n     - debian/patches/CVE-2026-40684.patch: harden string_copy_dnsdomain()\n       to consume 1, 2, or 3 digits incrementally instead of indexing past\n       the input string when fewer than 3 digits follow a backslash escape\n     - CVE-2026-40684\n   * SECURITY UPDATE: out-of-bounds heap write in JSON dewrap on malformed\n     header value ending in a trailing backslash\n     - debian/patches/CVE-2026-40685.patch: only skip a backslash in\n       dewrap() when followed by a non-NUL character\n     - CVE-2026-40685\n   * SECURITY UPDATE: SPA authenticator out-of-bounds write and\n     uninitialised-heap information disclosure\n     - debian/patches/CVE-2026-40687.patch: zero the spa_base64_to_bits()\n       output buffer to plug the infoleak; replace assert()-based length\n       guards in unicodeToString(), strToUnicode(), and toString() with\n       explicit length clamping to prevent OOB writes\n     - CVE-2026-40687","status":"published","published":"2026-05-05T17:52:50Z","modified":"2026-06-04T10:03:58.992093Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778147239","title":"exim: Fix of CVE-2026-40685","description":"- CVE-2026-40685: fix OOB heap write in dewrap() during JSON expansion","status":"published","published":"2026-05-07T09:48:29Z","modified":"2026-06-01T00:33:26.00633201Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778147777","title":"exim: Fix of CVE-2026-40685","description":"- CVE-2026-40685: fix OOB heap write in dewrap() during JSON expansion","status":"published","published":"2026-05-08T11:40:55Z","modified":"2026-06-01T00:33:17.101218463Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778173472","title":"exim: Fix of 2 CVEs","description":"- CVE-2026-40685: fix heap corruption when expanding malformed JSON\n- CVE-2026-40687: fix heap buffer overflow and infoleak in SPA authenticator","status":"published","published":"2026-05-07T17:04:42Z","modified":"2026-06-01T00:33:18.905493333Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778297730","title":"exim: Fix of 2 CVEs","description":"- CVE-2026-40685: dewrap() OOB read/write on trailing backslash in JSON header\n- CVE-2026-40687: SPA authenticator OOB read/write and base64 decode infoleak\n- Refresh Exim-Maintainers-Keyring.asc to verify the 4.99.x release tarball signature","status":"published","published":"2026-05-09T03:35:35Z","modified":"2026-06-01T00:31:16.962196223Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778690104","title":"exim: Fix of CVE-2026-40685","description":"- CVE-2026-40685: fix OOB heap write in dewrap() when expanding header ending with stray backslash","status":"published","published":"2026-05-13T16:35:09Z","modified":"2026-06-01T00:32:52.223583817Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"USN-8228-1","title":"exim4 vulnerabilities","description":"It was discovered that Exim incorrectly handled parsing malformed JSON\nin message headers. A remote attacker could possibly use this issue to\nexecute arbitrary code. (CVE-2026-40685)\n\nIt was discovered that Exim incorrectly handled processing of UTF-8\ntrailing characters. A remote attacker could possibly use this issue to\nobtain sensitive information. (CVE-2026-40686)\n\nIt was discovered that Exim incorrectly handled SPA authenticator input.\nAn authenticated user could possibly use this issue to execute arbitrary\ncode. (CVE-2026-40687)","status":"published","published":"2026-05-04T11:50:57Z","modified":"2026-05-20T16:04:02.980895896Z","updated_at":"2026-11-02T16:58:22.951676Z"},{"id":"USN-8382-1","title":"exim4 vulnerabilities","description":"Timo Longin discovered that Exim incorrectly handled certain SMTP messages\nin PIPELINING/CHUNKING configurations. A remote attacker could possibly use\nthis issue to perform SMTP smuggling. This issue only affected Ubuntu\n14.04 LTS. (CVE-2023-51766)\n\nIt was discovered that Exim incorrectly handled certain malformed JSON\ndata in headers. A remote attacker could possibly use this issue to crash\nExim, resulting in a denial of service, or execute arbitrary code. This\nissue only affected Ubuntu 20.04 LTS. (CVE-2026-40685)\n\nIt was discovered that Exim incorrectly handled certain malformed UTF-8\nheaders. A remote attacker could possibly use this issue to obtain\nsensitive information. This issue only affected Ubuntu 20.04 LTS.\n(CVE-2026-40686)\n\nIt was discovered that Exim incorrectly handled certain SPA resources.\nA remote attacker could possibly use this issue to crash Exim, resulting in\na denial of service, or obtain sensitive information. This issue only\naffected Ubuntu 20.04 LTS. (CVE-2026-40687)\n\nIt was discovered that Exim incorrectly handled certain CHUNKING\ntransfers in some GnuTLS configurations. A remote attacker could possibly\nuse this issue to crash Exim, resulting in a denial of service, or execute\narbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-45185)\n\nWarisjeet Singh discovered that Exim incorrectly handled certain proxy\nconnections in builds with proxy support enabled. A remote attacker could\npossibly use this issue to obtain sensitive information. This issue only\naffected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.\n(CVE-2026-48840)","status":"published","published":"2026-06-03T16:29:23Z","modified":"2026-06-04T02:18:10.818665128Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}