{"id":"CVE-2026-40687","aliases":["ALPINE-CVE-2026-40687","CLSA-2026-1778003565","CLSA-2026-1778024392","CLSA-2026-1778024757","CLSA-2026-1778173472","CLSA-2026-1778297730","CLSA-2026-1779369819","DEBIAN-CVE-2026-40687","EUVD-2026-26445","GHSA-x8x4-4g6x-cx4h","ROOT-OS-DEBIAN-11-CVE-2026-40687","UBUNTU-CVE-2026-40687","USN-8382-1"],"status":"published","title":"In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA...","description":"In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00373,"percentile":0.31605,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-909"],"published":"2026-04-29T12:00:00Z","modified":"2026-11-03T06:33:02Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"exim","fixed_in":["4.98.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"exim","fixed_in":["4.98.2-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"exim","fixed_in":["4.92.3-3.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"exim-greylist","fixed_in":["4.92.3-3.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"exim-mon","fixed_in":["4.92.3-3.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"exim-mysql","fixed_in":["4.92.3-3.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"exim-pgsql","fixed_in":["4.92.3-3.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"exim","fixed_in":["4.92.3-3.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"exim-greylist","fixed_in":["4.92.3-3.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"exim-mon","fixed_in":["4.92.3-3.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"exim-mysql","fixed_in":["4.92.3-3.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"exim-pgsql","fixed_in":["4.92.3-3.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"exim4","fixed_in":["4.96-15+deb12u9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"exim4","fixed_in":["4.98.2-1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"exim4","fixed_in":["4.99.2-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"exim4","fixed_in":["4.94.2-7+deb11u6.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-exim4","fixed_in":["4.94.2-7+deb11u6.aikido.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exim4","fixed_in":["4.93-13ubuntu1.12+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"exim4","fixed_in":["4.95-4ubuntu2.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"exim4","fixed_in":["4.97-4ubuntu4.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"exim4","fixed_in":["4.98.2-1ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"exim4","fixed_in":["4.99.1-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-daemon-heavy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-daemon-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"eximon4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.92.3-3.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-daemon-heavy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-daemon-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"eximon4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.96-15+deb12u9"}]}],"versions":["4.96-15","4.96-15+deb12u1","4.96-15+deb12u2","4.96-15+deb12u3","4.96-15+deb12u4","4.96-15+deb12u5","4.96-15+deb12u6","4.96-15+deb12u7","4.96-15+deb12u8"]},{"source":"osv","ecosystem":"Debian:13","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-1+deb13u2"}]}],"versions":["4.98.2-1","4.98.2-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.2-1"}]}],"versions":["4.98.2-1","4.98.2-1+hurd.1","4.98.2-2","4.99-1","4.99-2","4.99-3","4.99-4","4.99-4~bpo13+1","4.99-5","4.99-6","4.99-6~bpo13+1","4.99-7","4.99-7~bpo13+1","4.99.1-1","4.99.1-1~bpo13+1","4.99.1-2","4.99.1-3","4.99.1-4","4.99.1-5","4.99.1-6","4.99.2-1~bpo13+1","4.99~RC1-1","4.99~RC2-1","4.99~RC3-1","4.99~RC3-2"]},{"source":"osv","ecosystem":"Root:Debian:11","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.94.2-7+deb11u6.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.94.2-7+deb11u6.aikido.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.80-7ubuntu3","4.80-7ubuntu4","4.80-9ubuntu1","4.80-9ubuntu2","4.82-3ubuntu1","4.82-3ubuntu2","4.82-3ubuntu2.1","4.82-3ubuntu2.2","4.82-3ubuntu2.3","4.82-3ubuntu2.4","4.82-3ubuntu2.4+esm1","4.82-3ubuntu2.4+esm2","4.82-3ubuntu2.4+esm3","4.82-3ubuntu2.4+esm4","4.82-3ubuntu2.4+esm6","4.82-3ubuntu2.4+esm7","4.82-3ubuntu2.4+esm8","4.82-3ubuntu2.4+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.86-3ubuntu1","4.86-7ubuntu1","4.86-7ubuntu2","4.86-7ubuntu3","4.86.2-2ubuntu1","4.86.2-2ubuntu2","4.86.2-2ubuntu2.1","4.86.2-2ubuntu2.2","4.86.2-2ubuntu2.3","4.86.2-2ubuntu2.4","4.86.2-2ubuntu2.5","4.86.2-2ubuntu2.6","4.86.2-2ubuntu2.6+esm1","4.86.2-2ubuntu2.6+esm2","4.86.2-2ubuntu2.6+esm4","4.86.2-2ubuntu2.6+esm5","4.86.2-2ubuntu2.6+esm6","4.86.2-2ubuntu2.6+esm7","4.86.2-2ubuntu2.6+esm8","4.86.2-2ubuntu2.6+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.89-5ubuntu1","4.89-9ubuntu1","4.89-9ubuntu2","4.89-9ubuntu3","4.89-9ubuntu4","4.90.1-1ubuntu1","4.90.1-1ubuntu1.1","4.90.1-1ubuntu1.2","4.90.1-1ubuntu1.3","4.90.1-1ubuntu1.4","4.90.1-1ubuntu1.5","4.90.1-1ubuntu1.8","4.90.1-1ubuntu1.9","4.90.1-1ubuntu1.10","4.90.1-1ubuntu1.10+esm1","4.90.1-1ubuntu1.10+esm2","4.90.1-1ubuntu1.10+esm3","4.90.1-1ubuntu1.10+esm4","4.90.1-1ubuntu1.10+esm5","4.90.1-1ubuntu1.10+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+esm1"}]}],"versions":["4.92.1-1ubuntu3","4.92.1-1ubuntu4","4.93~RC2-1ubuntu1","4.93-9ubuntu1","4.93-11ubuntu1","4.93-12ubuntu1","4.93-13ubuntu1","4.93-13ubuntu1.1","4.93-13ubuntu1.5","4.93-13ubuntu1.6","4.93-13ubuntu1.7","4.93-13ubuntu1.8","4.93-13ubuntu1.9","4.93-13ubuntu1.10","4.93-13ubuntu1.11","4.93-13ubuntu1.12"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.95-4ubuntu2.7"}]}],"versions":["4.94.2-7ubuntu2","4.95-2ubuntu2","4.95-4ubuntu1","4.95-4ubuntu2","4.95-4ubuntu2.1","4.95-4ubuntu2.2","4.95-4ubuntu2.3","4.95-4ubuntu2.4","4.95-4ubuntu2.5","4.95-4ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97-4ubuntu4.4"}]}],"versions":["4.96-17ubuntu2","4.96-17ubuntu2.1","4.97-3ubuntu1","4.97-4ubuntu1","4.97-4ubuntu3","4.97-4ubuntu4","4.97-4ubuntu4.1","4.97-4ubuntu4.2","4.97-4ubuntu4.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-1ubuntu2.1"}]}],"versions":["4.98.1-1ubuntu2","4.98.2-1ubuntu1","4.98.2-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1ubuntu1.1"}]}],"versions":["4.98.2-1ubuntu2","4.99-4ubuntu1","4.99.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.82-3ubuntu2.4+esm9"}]}],"versions":["4.80-7ubuntu3","4.80-7ubuntu4","4.80-9ubuntu1","4.80-9ubuntu2","4.82-3ubuntu1","4.82-3ubuntu2","4.82-3ubuntu2.1","4.82-3ubuntu2.2","4.82-3ubuntu2.3","4.82-3ubuntu2.4","4.82-3ubuntu2.4+esm1","4.82-3ubuntu2.4+esm2","4.82-3ubuntu2.4+esm3","4.82-3ubuntu2.4+esm4","4.82-3ubuntu2.4+esm6","4.82-3ubuntu2.4+esm7","4.82-3ubuntu2.4+esm8"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.86.2-2ubuntu2.6+esm9"}]}],"versions":["4.86-3ubuntu1","4.86-7ubuntu1","4.86-7ubuntu2","4.86-7ubuntu3","4.86.2-2ubuntu1","4.86.2-2ubuntu2","4.86.2-2ubuntu2.1","4.86.2-2ubuntu2.2","4.86.2-2ubuntu2.3","4.86.2-2ubuntu2.4","4.86.2-2ubuntu2.5","4.86.2-2ubuntu2.6","4.86.2-2ubuntu2.6+esm1","4.86.2-2ubuntu2.6+esm2","4.86.2-2ubuntu2.6+esm4","4.86.2-2ubuntu2.6+esm5","4.86.2-2ubuntu2.6+esm6","4.86.2-2ubuntu2.6+esm7","4.86.2-2ubuntu2.6+esm8"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+esm6"}]}],"versions":["4.89-5ubuntu1","4.89-9ubuntu1","4.89-9ubuntu2","4.89-9ubuntu3","4.89-9ubuntu4","4.90.1-1ubuntu1","4.90.1-1ubuntu1.1","4.90.1-1ubuntu1.2","4.90.1-1ubuntu1.3","4.90.1-1ubuntu1.4","4.90.1-1ubuntu1.5","4.90.1-1ubuntu1.8","4.90.1-1ubuntu1.9","4.90.1-1ubuntu1.10","4.90.1-1ubuntu1.10+esm1","4.90.1-1ubuntu1.10+esm2","4.90.1-1ubuntu1.10+esm3","4.90.1-1ubuntu1.10+esm4","4.90.1-1ubuntu1.10+esm5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+esm1"}]}],"versions":["4.92.1-1ubuntu3","4.92.1-1ubuntu4","4.93~RC2-1ubuntu1","4.93-9ubuntu1","4.93-11ubuntu1","4.93-12ubuntu1","4.93-13ubuntu1","4.93-13ubuntu1.1","4.93-13ubuntu1.5","4.93-13ubuntu1.6","4.93-13ubuntu1.7","4.93-13ubuntu1.8","4.93-13ubuntu1.9","4.93-13ubuntu1.10","4.93-13ubuntu1.11","4.93-13ubuntu1.12"],"bundled":6}],"products":[{"vendor":"exim","product":"exim"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2026/04/30/21","tags":["Mailing List","Third Party Advisory"]},{"url":"https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40687.assessment","tags":["Vendor Advisory"]},{"url":"https://code.exim.org/exim/exim/commit/68b963b9f75ca27b38e1c0f8c87037990199f505","tags":["Patch"]},{"url":"https://exim.org/static/doc/security/CVE-2026-40687.txt","tags":["Broken Link"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40687"},{"url":"https://exim.org/static/doc/security/CVE-2025-40687.txt"},{"url":"https://github.com/advisories/GHSA-x8x4-4g6x-cx4h"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-40687","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1778003565.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1778024392.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1778024757.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1778173472.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778297730.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1779369819.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-40687","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-40687","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40687","tags":["report"]},{"url":"https://lists.exim.org/lurker/message/20260429.121733.f58d9686.en.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8228-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8382-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-51766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40686","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-48840","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-40687","description":"In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.","status":"published","published":"2026-04-30T00:00:00Z","modified":"2026-05-01T14:25:12.276Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-909"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-26445","description":"In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.","status":"published","published":"2026-04-30T00:00:00Z","modified":"2026-05-01T14:25:12Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:05:18.723006Z"}],"ghsa":[{"id":"GHSA-x8x4-4g6x-cx4h","title":"In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA...","description":"In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.","status":"published","published":"2026-05-01T00:31:27Z","modified":"2026-05-01T03:31:23Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-909"],"updated_at":"2026-11-02T15:07:52.84276Z"}],"nvd":[{"id":"CVE-2026-40687","description":"In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.","status":"published","published":"2026-04-30T22:16:25.923Z","modified":"2026-11-11T21:10:00.2Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-909"],"updated_at":"2026-11-11T23:26:36.997374Z"}],"osv":[{"id":"ALPINE-CVE-2026-40687","description":"In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.","status":"published","published":"2026-04-30T22:16:25.923Z","modified":"2026-11-03T06:33:02.771591534Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"DEBIAN-CVE-2026-40687","description":"In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.","status":"published","published":"2026-04-30T22:16:25.923Z","modified":"2026-10-01T03:03:04.760487957Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-40687","title":"CVE-2026-40687 in exim4 - Patched by Root","description":"Root has patched CVE-2026-40687 in the exim4 package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-24T10:01:38Z","modified":"2026-08-24T12:30:07.695672285Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"UBUNTU-CVE-2026-40687","description":"In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.","status":"published","published":"2026-04-29T12:00:00Z","modified":"2026-06-04T02:14:18.974847271Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"CLSA-2026-1778003565","title":"Fix CVE(s): CVE-2026-40684, CVE-2026-40685, CVE-2026-40687","description":"   * SECURITY UPDATE: out-of-bounds read in DNS reverse-lookup escape\n     decoding when running against musl libc\n     - debian/patches/CVE-2026-40684.patch: harden string_copy_dnsdomain()\n       to consume 1, 2, or 3 digits incrementally instead of indexing past\n       the input string when fewer than 3 digits follow a backslash escape\n     - CVE-2026-40684\n   * SECURITY UPDATE: out-of-bounds heap write in JSON dewrap on malformed\n     header value ending in a trailing backslash\n     - debian/patches/CVE-2026-40685.patch: only skip a backslash in\n       dewrap() when followed by a non-NUL character\n     - CVE-2026-40685\n   * SECURITY UPDATE: SPA authenticator out-of-bounds write and\n     uninitialised-heap information disclosure\n     - debian/patches/CVE-2026-40687.patch: zero the spa_base64_to_bits()\n       output buffer to plug the infoleak; replace assert()-based length\n       guards in unicodeToString(), strToUnicode(), and toString() with\n       explicit length clamping to prevent OOB writes\n     - CVE-2026-40687","status":"published","published":"2026-05-05T17:52:50Z","modified":"2026-06-04T10:03:58.992093Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778024392","title":"exim: Fix of CVE-2026-40687","description":"- CVE-2026-40687: fix uninitialized buffer and out-of-bounds writes in SPA authenticator","status":"published","published":"2026-05-05T23:39:58Z","modified":"2026-06-01T00:32:44.270528446Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778024757","title":"exim: Fix of CVE-2026-40687","description":"- CVE-2026-40687: fix uninitialized buffer and out-of-bounds writes in SPA authenticator","status":"published","published":"2026-05-05T23:46:06Z","modified":"2026-06-01T00:33:26.010697912Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778173472","title":"exim: Fix of 2 CVEs","description":"- CVE-2026-40685: fix heap corruption when expanding malformed JSON\n- CVE-2026-40687: fix heap buffer overflow and infoleak in SPA authenticator","status":"published","published":"2026-05-07T17:04:42Z","modified":"2026-06-01T00:33:18.905493333Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778297730","title":"exim: Fix of 2 CVEs","description":"- CVE-2026-40685: dewrap() OOB read/write on trailing backslash in JSON header\n- CVE-2026-40687: SPA authenticator OOB read/write and base64 decode infoleak\n- Refresh Exim-Maintainers-Keyring.asc to verify the 4.99.x release tarball signature","status":"published","published":"2026-05-09T03:35:35Z","modified":"2026-06-01T00:31:16.962196223Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779369819","title":"Fix CVE(s): CVE-2026-40686, CVE-2026-40687","description":"   * SECURITY UPDATE: heap read out-of-bounds in UTF-8 expansion\n     - debian/patches/CVE-2026-40686.patch: harden ${from_utf8:} expansion\n       operator against malformed UTF-8 trailing bytes.\n     - CVE-2026-40686\n   * SECURITY UPDATE: SPA authenticator buffer hardening\n     - debian/patches/CVE-2026-40687.patch: zero spa_base64_to_bits output\n       buffer and replace static 1024-byte buffers in unicodeToString,\n       strToUnicode, toString with dynamic store_get allocations sized to\n       input.\n     - CVE-2026-40687","status":"published","published":"2026-05-21T13:23:43Z","modified":"2026-06-04T10:03:35.366027Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"USN-8382-1","title":"exim4 vulnerabilities","description":"Timo Longin discovered that Exim incorrectly handled certain SMTP messages\nin PIPELINING/CHUNKING configurations. A remote attacker could possibly use\nthis issue to perform SMTP smuggling. This issue only affected Ubuntu\n14.04 LTS. (CVE-2023-51766)\n\nIt was discovered that Exim incorrectly handled certain malformed JSON\ndata in headers. A remote attacker could possibly use this issue to crash\nExim, resulting in a denial of service, or execute arbitrary code. This\nissue only affected Ubuntu 20.04 LTS. (CVE-2026-40685)\n\nIt was discovered that Exim incorrectly handled certain malformed UTF-8\nheaders. A remote attacker could possibly use this issue to obtain\nsensitive information. This issue only affected Ubuntu 20.04 LTS.\n(CVE-2026-40686)\n\nIt was discovered that Exim incorrectly handled certain SPA resources.\nA remote attacker could possibly use this issue to crash Exim, resulting in\na denial of service, or obtain sensitive information. This issue only\naffected Ubuntu 20.04 LTS. (CVE-2026-40687)\n\nIt was discovered that Exim incorrectly handled certain CHUNKING\ntransfers in some GnuTLS configurations. A remote attacker could possibly\nuse this issue to crash Exim, resulting in a denial of service, or execute\narbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-45185)\n\nWarisjeet Singh discovered that Exim incorrectly handled certain proxy\nconnections in builds with proxy support enabled. A remote attacker could\npossibly use this issue to obtain sensitive information. This issue only\naffected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.\n(CVE-2026-48840)","status":"published","published":"2026-06-03T16:29:23Z","modified":"2026-06-04T02:18:10.818665128Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}