{"id":"CVE-2026-45185","aliases":["CLSA-2026-1781269872","DEBIAN-CVE-2026-45185","EUVD-2026-29824","GHSA-fhg4-whcv-f8v4","UBUNTU-CVE-2026-45185","USN-8382-1"],"status":"published","title":"Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in...","description":"Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0127,"percentile":0.70178,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-416"],"published":"2026-05-12T00:00:00Z","modified":"2026-10-26T09:32:05Z","exploits":[{"source":"pocgithub","id":"liamromanis101/Dead.Letter-CVE-2026-45185","title":"liamromanis101/Dead.Letter-CVE-2026-45185","date":"2026-05-12","url":"https://github.com/liamromanis101/Dead.Letter-CVE-2026-45185"},{"source":"pocgithub","id":"materaj2/cve-2026-45185-detection-script","title":"materaj2/cve-2026-45185-detection-script","date":"2026-05-14","url":"https://github.com/materaj2/cve-2026-45185-detection-script"},{"source":"pocgithub","id":"MJ-bin/POC_CVE-2026-45185","title":"MJ-bin/POC_CVE-2026-45185","date":"2026-05-19","url":"https://github.com/MJ-bin/POC_CVE-2026-45185"},{"source":"pocgithub","id":"0init/CVE-2026-45185","title":"0init/CVE-2026-45185","date":"2026-08-07","url":"https://github.com/0init/CVE-2026-45185"}],"fixes":[{"ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4","fixed_in":["4.93-13ubuntu1.12+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-base","fixed_in":["4.93-13ubuntu1.12+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-config","fixed_in":["4.93-13ubuntu1.12+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-daemon-heavy","fixed_in":["4.93-13ubuntu1.12+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-daemon-light","fixed_in":["4.93-13ubuntu1.12+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-dev","fixed_in":["4.93-13ubuntu1.12+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"eximon4","fixed_in":["4.93-13ubuntu1.12+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"exim4","fixed_in":["4.96-15+deb12u9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"exim4","fixed_in":["4.98.2-1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"exim4","fixed_in":["4.99.2-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exim4","fixed_in":["4.93-13ubuntu1.12+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"exim4","fixed_in":["4.95-4ubuntu2.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"exim4","fixed_in":["4.97-4ubuntu4.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"exim4","fixed_in":["4.98.2-1ubuntu2.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"exim4","fixed_in":["4.99.1-1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-daemon-heavy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-daemon-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"eximon4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.96-15+deb12u9"}]}],"versions":["4.96-15","4.96-15+deb12u1","4.96-15+deb12u2","4.96-15+deb12u3","4.96-15+deb12u4","4.96-15+deb12u5","4.96-15+deb12u6","4.96-15+deb12u7","4.96-15+deb12u8"]},{"source":"osv","ecosystem":"Debian:13","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-1+deb13u2"}]}],"versions":["4.98.2-1","4.98.2-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.2-2"}]}],"versions":["4.98.2-1","4.98.2-1+hurd.1","4.98.2-2","4.99-1","4.99-2","4.99-3","4.99-4","4.99-4~bpo13+1","4.99-5","4.99-6","4.99-6~bpo13+1","4.99-7","4.99-7~bpo13+1","4.99.1-1","4.99.1-1~bpo13+1","4.99.1-2","4.99.1-3","4.99.1-4","4.99.1-5","4.99.1-6","4.99.2-1","4.99.2-1~bpo13+1","4.99.2-2~bpo13+1","4.99~RC1-1","4.99~RC2-1","4.99~RC3-1","4.99~RC3-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.80-7ubuntu3","4.80-7ubuntu4","4.80-9ubuntu1","4.80-9ubuntu2","4.82-3ubuntu1","4.82-3ubuntu2","4.82-3ubuntu2.1","4.82-3ubuntu2.2","4.82-3ubuntu2.3","4.82-3ubuntu2.4","4.82-3ubuntu2.4+esm1","4.82-3ubuntu2.4+esm2","4.82-3ubuntu2.4+esm3","4.82-3ubuntu2.4+esm4","4.82-3ubuntu2.4+esm6","4.82-3ubuntu2.4+esm7","4.82-3ubuntu2.4+esm8","4.82-3ubuntu2.4+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.86-3ubuntu1","4.86-7ubuntu1","4.86-7ubuntu2","4.86-7ubuntu3","4.86.2-2ubuntu1","4.86.2-2ubuntu2","4.86.2-2ubuntu2.1","4.86.2-2ubuntu2.2","4.86.2-2ubuntu2.3","4.86.2-2ubuntu2.4","4.86.2-2ubuntu2.5","4.86.2-2ubuntu2.6","4.86.2-2ubuntu2.6+esm1","4.86.2-2ubuntu2.6+esm2","4.86.2-2ubuntu2.6+esm4","4.86.2-2ubuntu2.6+esm5","4.86.2-2ubuntu2.6+esm6","4.86.2-2ubuntu2.6+esm7","4.86.2-2ubuntu2.6+esm8","4.86.2-2ubuntu2.6+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.89-5ubuntu1","4.89-9ubuntu1","4.89-9ubuntu2","4.89-9ubuntu3","4.89-9ubuntu4","4.90.1-1ubuntu1","4.90.1-1ubuntu1.1","4.90.1-1ubuntu1.2","4.90.1-1ubuntu1.3","4.90.1-1ubuntu1.4","4.90.1-1ubuntu1.5","4.90.1-1ubuntu1.8","4.90.1-1ubuntu1.9","4.90.1-1ubuntu1.10","4.90.1-1ubuntu1.10+esm1","4.90.1-1ubuntu1.10+esm2","4.90.1-1ubuntu1.10+esm3","4.90.1-1ubuntu1.10+esm4","4.90.1-1ubuntu1.10+esm5","4.90.1-1ubuntu1.10+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+esm1"}]}],"versions":["4.92.1-1ubuntu3","4.92.1-1ubuntu4","4.93~RC2-1ubuntu1","4.93-9ubuntu1","4.93-11ubuntu1","4.93-12ubuntu1","4.93-13ubuntu1","4.93-13ubuntu1.1","4.93-13ubuntu1.5","4.93-13ubuntu1.6","4.93-13ubuntu1.7","4.93-13ubuntu1.8","4.93-13ubuntu1.9","4.93-13ubuntu1.10","4.93-13ubuntu1.11","4.93-13ubuntu1.12"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.95-4ubuntu2.8"}]}],"versions":["4.94.2-7ubuntu2","4.95-2ubuntu2","4.95-4ubuntu1","4.95-4ubuntu2","4.95-4ubuntu2.1","4.95-4ubuntu2.2","4.95-4ubuntu2.3","4.95-4ubuntu2.4","4.95-4ubuntu2.5","4.95-4ubuntu2.6","4.95-4ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97-4ubuntu4.5"}]}],"versions":["4.96-17ubuntu2","4.96-17ubuntu2.1","4.97-3ubuntu1","4.97-4ubuntu1","4.97-4ubuntu3","4.97-4ubuntu4","4.97-4ubuntu4.1","4.97-4ubuntu4.2","4.97-4ubuntu4.3","4.97-4ubuntu4.4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-1ubuntu2.2"}]}],"versions":["4.98.1-1ubuntu2","4.98.2-1ubuntu1","4.98.2-1ubuntu2","4.98.2-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1ubuntu1.2"}]}],"versions":["4.98.2-1ubuntu2","4.99-4ubuntu1","4.99.1-1ubuntu1","4.99.1-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.82-3ubuntu2.4+esm9"}]}],"versions":["4.80-7ubuntu3","4.80-7ubuntu4","4.80-9ubuntu1","4.80-9ubuntu2","4.82-3ubuntu1","4.82-3ubuntu2","4.82-3ubuntu2.1","4.82-3ubuntu2.2","4.82-3ubuntu2.3","4.82-3ubuntu2.4","4.82-3ubuntu2.4+esm1","4.82-3ubuntu2.4+esm2","4.82-3ubuntu2.4+esm3","4.82-3ubuntu2.4+esm4","4.82-3ubuntu2.4+esm6","4.82-3ubuntu2.4+esm7","4.82-3ubuntu2.4+esm8"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.86.2-2ubuntu2.6+esm9"}]}],"versions":["4.86-3ubuntu1","4.86-7ubuntu1","4.86-7ubuntu2","4.86-7ubuntu3","4.86.2-2ubuntu1","4.86.2-2ubuntu2","4.86.2-2ubuntu2.1","4.86.2-2ubuntu2.2","4.86.2-2ubuntu2.3","4.86.2-2ubuntu2.4","4.86.2-2ubuntu2.5","4.86.2-2ubuntu2.6","4.86.2-2ubuntu2.6+esm1","4.86.2-2ubuntu2.6+esm2","4.86.2-2ubuntu2.6+esm4","4.86.2-2ubuntu2.6+esm5","4.86.2-2ubuntu2.6+esm6","4.86.2-2ubuntu2.6+esm7","4.86.2-2ubuntu2.6+esm8"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+esm6"}]}],"versions":["4.89-5ubuntu1","4.89-9ubuntu1","4.89-9ubuntu2","4.89-9ubuntu3","4.89-9ubuntu4","4.90.1-1ubuntu1","4.90.1-1ubuntu1.1","4.90.1-1ubuntu1.2","4.90.1-1ubuntu1.3","4.90.1-1ubuntu1.4","4.90.1-1ubuntu1.5","4.90.1-1ubuntu1.8","4.90.1-1ubuntu1.9","4.90.1-1ubuntu1.10","4.90.1-1ubuntu1.10+esm1","4.90.1-1ubuntu1.10+esm2","4.90.1-1ubuntu1.10+esm3","4.90.1-1ubuntu1.10+esm4","4.90.1-1ubuntu1.10+esm5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+esm1"}]}],"versions":["4.92.1-1ubuntu3","4.92.1-1ubuntu4","4.93~RC2-1ubuntu1","4.93-9ubuntu1","4.93-11ubuntu1","4.93-12ubuntu1","4.93-13ubuntu1","4.93-13ubuntu1.1","4.93-13ubuntu1.5","4.93-13ubuntu1.6","4.93-13ubuntu1.7","4.93-13ubuntu1.8","4.93-13ubuntu1.9","4.93-13ubuntu1.10","4.93-13ubuntu1.11","4.93-13ubuntu1.12"],"bundled":6}],"products":[{"vendor":"exim","product":"exim"}],"references":[{"url":"https://exim.org","tags":["Product"]},{"url":"https://code.exim.org/exim/wiki/wiki/EximSecurity","tags":["Vendor Advisory"]},{"url":"https://exim.org/static/doc/security/CVE-2026-45185.txt","tags":["Broken Link"]},{"url":"https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim","tags":["Third Party Advisory","report"]},{"url":"https://news.ycombinator.com/item?id=48111748","tags":["Issue Tracking"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/12/4","tags":["Mailing List","Third Party Advisory"]},{"url":"https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/","tags":["Release Notes"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/12/25","tags":["Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45185","tags":["advisory"]},{"url":"https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1"},{"url":"https://github.com/advisories/GHSA-fhg4-whcv-f8v4"},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1781269872.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-45185","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-45185","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45185","tags":["report"]},{"url":"https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/EXIM-Security-2026-05-01.1.txt","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8270-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8382-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-51766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40686","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-48840","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-45185","description":"Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.","status":"published","published":"2026-05-12T00:00:00Z","modified":"2026-05-14T03:55:55.967Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T13:46:43.922571Z"}],"euvd":[{"id":"EUVD-2026-29824","description":"Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.","status":"published","published":"2026-05-12T00:00:00Z","modified":"2026-05-14T03:55:55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:04:31.993983Z"}],"ghsa":[{"id":"GHSA-fhg4-whcv-f8v4","title":"Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in...","description":"Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.","status":"published","published":"2026-05-12T21:31:35Z","modified":"2026-05-13T18:30:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:08:07.151918Z"}],"nvd":[{"id":"CVE-2026-45185","description":"Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.","status":"published","published":"2026-05-12T20:16:46.137Z","modified":"2026-11-11T20:10:00.273Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-11T21:26:15.366289Z"}],"osv":[{"id":"DEBIAN-CVE-2026-45185","description":"Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.","status":"published","published":"2026-05-12T20:16:46.137Z","modified":"2026-10-01T03:03:05.945902448Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"UBUNTU-CVE-2026-45185","description":"Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.","status":"published","published":"2026-05-12T20:16:00Z","modified":"2026-06-04T02:14:18.800130417Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"CLSA-2026-1781269872","title":"Fix CVE(s): CVE-2026-45185","description":"   * SECURITY UPDATE: TLS close_notify use-after-free during active BDAT/CHUNKING\n     transfer that can lead to unauthenticated remote code execution\n     - debian/patches/CVE-2026-45185.patch: introduce tls_close_notify() that\n       pops the BDAT receive layer, reinstalls plaintext receive callbacks via\n       a new smtp_rcv_cleartext() helper, then re-pushes the BDAT layer before\n       closing the TLS channel; switch the GnuTLS and OpenSSL receive paths\n       from a bare tls_close() to tls_close_notify()\n     - CVE-2026-45185","status":"published","published":"2026-06-12T13:13:18Z","modified":"2026-10-26T09:32:05.234068016Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"USN-8382-1","title":"exim4 vulnerabilities","description":"Timo Longin discovered that Exim incorrectly handled certain SMTP messages\nin PIPELINING/CHUNKING configurations. A remote attacker could possibly use\nthis issue to perform SMTP smuggling. This issue only affected Ubuntu\n14.04 LTS. (CVE-2023-51766)\n\nIt was discovered that Exim incorrectly handled certain malformed JSON\ndata in headers. A remote attacker could possibly use this issue to crash\nExim, resulting in a denial of service, or execute arbitrary code. This\nissue only affected Ubuntu 20.04 LTS. (CVE-2026-40685)\n\nIt was discovered that Exim incorrectly handled certain malformed UTF-8\nheaders. A remote attacker could possibly use this issue to obtain\nsensitive information. This issue only affected Ubuntu 20.04 LTS.\n(CVE-2026-40686)\n\nIt was discovered that Exim incorrectly handled certain SPA resources.\nA remote attacker could possibly use this issue to crash Exim, resulting in\na denial of service, or obtain sensitive information. This issue only\naffected Ubuntu 20.04 LTS. (CVE-2026-40687)\n\nIt was discovered that Exim incorrectly handled certain CHUNKING\ntransfers in some GnuTLS configurations. A remote attacker could possibly\nuse this issue to crash Exim, resulting in a denial of service, or execute\narbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-45185)\n\nWarisjeet Singh discovered that Exim incorrectly handled certain proxy\nconnections in builds with proxy support enabled. A remote attacker could\npossibly use this issue to obtain sensitive information. This issue only\naffected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.\n(CVE-2026-48840)","status":"published","published":"2026-06-03T16:29:23Z","modified":"2026-06-04T02:18:10.818665128Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}