{"id":"CVE-2026-94054","aliases":["CLSA-2026-1790254810","CLSA-2026-1790290858","CLSA-2026-1790290861","CLSA-2026-1790608554","CLSA-2026-1790759113","CLSA-2026-1791401562","CLSA-2026-1791403476","DEBIAN-CVE-2026-94054","EUVD-2026-83612","GHSA-r24f-7cqq-88w4","ROOT-OS-DEBIAN-12-CVE-2026-94054","ROOT-OS-DEBIAN-13-CVE-2026-94054","UBUNTU-CVE-2026-94054","USN-8834-1"],"status":"published","title":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of...","description":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00268,"percentile":0.19137,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-09-19T22:46:24Z","modified":"2026-10-26T09:32:03Z","fixes":[{"ecosystem":"TuxCare:CentOS:8.5","package":"exim","fixed_in":["4.99.5-1.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"exim-greylist","fixed_in":["4.99.5-1.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"exim-mon","fixed_in":["4.99.5-1.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"exim-mysql","fixed_in":["4.99.5-1.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"exim-pgsql","fixed_in":["4.99.5-1.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"exim","fixed_in":["4.99.5-1.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"exim-greylist","fixed_in":["4.99.5-1.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"exim-mon","fixed_in":["4.99.5-1.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"exim-mysql","fixed_in":["4.99.5-1.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"exim-pgsql","fixed_in":["4.99.5-1.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"exim","fixed_in":["4.97.1-1.el7.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"exim-greylist","fixed_in":["4.97.1-1.el7.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"exim-mon","fixed_in":["4.97.1-1.el7.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"exim-mysql","fixed_in":["4.97.1-1.el7.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"exim-pgsql","fixed_in":["4.97.1-1.el7.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"exim-sysvinit","fixed_in":["4.97.1-1.el7.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"exim4","fixed_in":["4.98.2-1+deb13u5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"exim4","fixed_in":["4.100.1-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"exim4","fixed_in":["4.96-15+deb12u10.aikido.4"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-exim4","fixed_in":["4.96-15+deb12u10.aikido.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"exim4","fixed_in":["4.95-4ubuntu2.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"exim4","fixed_in":["4.97-4ubuntu4.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"exim4","fixed_in":["4.99.1-1ubuntu1.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-daemon-heavy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-daemon-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"eximon4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-daemon-heavy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-daemon-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"eximon4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.100-1","4.100-1~bpo13+1","4.100-3","4.100-4","4.100.1-1","4.100.1-1~bpo13+1","4.100.1-2","4.100~RC1-1","4.100~RC2-1","4.100~RC3-1","4.100~RC3-2","4.96-15","4.96-15+deb12u1","4.96-15+deb12u10","4.96-15+deb12u2","4.96-15+deb12u3","4.96-15+deb12u4","4.96-15+deb12u5","4.96-15+deb12u6","4.96-15+deb12u7","4.96-15+deb12u8","4.96-15+deb12u9","4.96-16","4.96-17","4.96-18","4.96-19","4.96-20","4.96-21","4.96-22","4.97-1","4.97-1~hurd.2","4.97-2","4.97-3","4.97-4","4.97-5","4.97-6","4.97-7","4.97-8","4.97-8~bpo12+1","4.97~RC0-1","4.97~RC0-2","4.97~RC0-3","4.97~RC1-1","4.97~RC1-2","4.97~RC2-1","4.97~RC2-2","4.97~RC3-1","4.98-1","4.98-1~bpo12+1","4.98-2","4.98-2~bpo12+1","4.98-3","4.98-3+hurd.1","4.98-3~bpo12+1","4.98-4","4.98.1-1","4.98.1-2","4.98.1-2~bpo12+1","4.98.2-1","4.98.2-1+hurd.1","4.98.2-1~bpo12+1","4.98.2-2","4.98~RC0-1","4.98~RC1-1","4.98~RC2-1","4.98~RC3-1","4.98~RC3-2","4.98~RC3-2~bpo12+1","4.99-1","4.99-2","4.99-3","4.99-4","4.99-4~bpo13+1","4.99-5","4.99-6","4.99-6~bpo13+1","4.99-7","4.99-7~bpo13+1","4.99.1-1","4.99.1-1~bpo13+1","4.99.1-2","4.99.1-3","4.99.1-4","4.99.1-5","4.99.1-6","4.99.2-1","4.99.2-1~bpo13+1","4.99.2-2","4.99.2-2~bpo13+1","4.99.3-1","4.99.3-2","4.99.3-2~bpo13+1","4.99.4-1","4.99.4-1~bpo13+1","4.99.4-2","4.99.4-2~bpo13+1","4.99~RC1-1","4.99~RC2-1","4.99~RC3-1","4.99~RC3-2"]},{"source":"osv","ecosystem":"Debian:13","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-1+deb13u5"}]}],"versions":["4.98.2-1","4.98.2-1+deb13u1","4.98.2-1+deb13u2","4.98.2-1+deb13u3","4.98.2-1+deb13u4"]},{"source":"osv","ecosystem":"Debian:14","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.100.1-1"}]}],"versions":["4.100-1","4.100-1~bpo13+1","4.100-3","4.100-4","4.100.1-1~bpo13+1","4.100~RC1-1","4.100~RC2-1","4.100~RC3-1","4.100~RC3-2","4.98.2-1","4.98.2-1+hurd.1","4.98.2-2","4.99-1","4.99-2","4.99-3","4.99-4","4.99-4~bpo13+1","4.99-5","4.99-6","4.99-6~bpo13+1","4.99-7","4.99-7~bpo13+1","4.99.1-1","4.99.1-1~bpo13+1","4.99.1-2","4.99.1-3","4.99.1-4","4.99.1-5","4.99.1-6","4.99.2-1","4.99.2-1~bpo13+1","4.99.2-2","4.99.2-2~bpo13+1","4.99.3-1","4.99.3-2","4.99.3-2~bpo13+1","4.99.4-1","4.99.4-1~bpo13+1","4.99.4-2","4.99.4-2~bpo13+1","4.99~RC1-1","4.99~RC2-1","4.99~RC3-1","4.99~RC3-2"]},{"source":"osv","ecosystem":"Root:Debian:12","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.96-15+deb12u10.aikido.4"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.96-15+deb12u10.aikido.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.80-7ubuntu3","4.80-7ubuntu4","4.80-9ubuntu1","4.80-9ubuntu2","4.82-3ubuntu1","4.82-3ubuntu2","4.82-3ubuntu2.1","4.82-3ubuntu2.2","4.82-3ubuntu2.3","4.82-3ubuntu2.4","4.82-3ubuntu2.4+esm1","4.82-3ubuntu2.4+esm2","4.82-3ubuntu2.4+esm3","4.82-3ubuntu2.4+esm4","4.82-3ubuntu2.4+esm6","4.82-3ubuntu2.4+esm7","4.82-3ubuntu2.4+esm8","4.82-3ubuntu2.4+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.86-3ubuntu1","4.86-7ubuntu1","4.86-7ubuntu2","4.86-7ubuntu3","4.86.2-2ubuntu1","4.86.2-2ubuntu2","4.86.2-2ubuntu2.1","4.86.2-2ubuntu2.2","4.86.2-2ubuntu2.3","4.86.2-2ubuntu2.4","4.86.2-2ubuntu2.5","4.86.2-2ubuntu2.6","4.86.2-2ubuntu2.6+esm1","4.86.2-2ubuntu2.6+esm2","4.86.2-2ubuntu2.6+esm4","4.86.2-2ubuntu2.6+esm5","4.86.2-2ubuntu2.6+esm6","4.86.2-2ubuntu2.6+esm7","4.86.2-2ubuntu2.6+esm8","4.86.2-2ubuntu2.6+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.89-5ubuntu1","4.89-9ubuntu1","4.89-9ubuntu2","4.89-9ubuntu3","4.89-9ubuntu4","4.90.1-1ubuntu1","4.90.1-1ubuntu1.1","4.90.1-1ubuntu1.2","4.90.1-1ubuntu1.3","4.90.1-1ubuntu1.4","4.90.1-1ubuntu1.5","4.90.1-1ubuntu1.8","4.90.1-1ubuntu1.9","4.90.1-1ubuntu1.10","4.90.1-1ubuntu1.10+esm1","4.90.1-1ubuntu1.10+esm2","4.90.1-1ubuntu1.10+esm3","4.90.1-1ubuntu1.10+esm4","4.90.1-1ubuntu1.10+esm5","4.90.1-1ubuntu1.10+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.92.1-1ubuntu3","4.92.1-1ubuntu4","4.93~RC2-1ubuntu1","4.93-9ubuntu1","4.93-11ubuntu1","4.93-12ubuntu1","4.93-13ubuntu1","4.93-13ubuntu1.1","4.93-13ubuntu1.5","4.93-13ubuntu1.6","4.93-13ubuntu1.7","4.93-13ubuntu1.8","4.93-13ubuntu1.9","4.93-13ubuntu1.10","4.93-13ubuntu1.11","4.93-13ubuntu1.12","4.93-13ubuntu1.12+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.95-4ubuntu2.12"}]}],"versions":["4.94.2-7ubuntu2","4.95-2ubuntu2","4.95-4ubuntu1","4.95-4ubuntu2","4.95-4ubuntu2.1","4.95-4ubuntu2.2","4.95-4ubuntu2.3","4.95-4ubuntu2.4","4.95-4ubuntu2.5","4.95-4ubuntu2.6","4.95-4ubuntu2.7","4.95-4ubuntu2.8","4.95-4ubuntu2.9","4.95-4ubuntu2.10","4.95-4ubuntu2.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97-4ubuntu4.8"}]}],"versions":["4.96-17ubuntu2","4.96-17ubuntu2.1","4.97-3ubuntu1","4.97-4ubuntu1","4.97-4ubuntu3","4.97-4ubuntu4","4.97-4ubuntu4.1","4.97-4ubuntu4.2","4.97-4ubuntu4.3","4.97-4ubuntu4.4","4.97-4ubuntu4.5","4.97-4ubuntu4.6","4.97-4ubuntu4.7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1ubuntu1.5"}]}],"versions":["4.98.2-1ubuntu2","4.99-4ubuntu1","4.99.1-1ubuntu1","4.99.1-1ubuntu1.1","4.99.1-1ubuntu1.2","4.99.1-1ubuntu1.3","4.99.1-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.95-4ubuntu2.12"}]}],"versions":["4.94.2-7ubuntu2","4.95-2ubuntu2","4.95-4ubuntu1","4.95-4ubuntu2","4.95-4ubuntu2.1","4.95-4ubuntu2.2","4.95-4ubuntu2.3","4.95-4ubuntu2.4","4.95-4ubuntu2.5","4.95-4ubuntu2.6","4.95-4ubuntu2.7","4.95-4ubuntu2.8","4.95-4ubuntu2.9","4.95-4ubuntu2.10","4.95-4ubuntu2.11"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97-4ubuntu4.8"}]}],"versions":["4.96-17ubuntu2","4.96-17ubuntu2.1","4.97-3ubuntu1","4.97-4ubuntu1","4.97-4ubuntu3","4.97-4ubuntu4","4.97-4ubuntu4.1","4.97-4ubuntu4.2","4.97-4ubuntu4.3","4.97-4ubuntu4.4","4.97-4ubuntu4.5","4.97-4ubuntu4.6","4.97-4ubuntu4.7"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1ubuntu1.5"}]}],"versions":["4.98.2-1ubuntu2","4.99-4ubuntu1","4.99.1-1ubuntu1","4.99.1-1ubuntu1.1","4.99.1-1ubuntu1.2","4.99.1-1ubuntu1.3","4.99.1-1ubuntu1.4"],"bundled":4}],"products":[{"vendor":"exim","product":"exim"}],"references":[{"url":"https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html","tags":["Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94054","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r24f-7cqq-88w4"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1790254810.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94057","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1790290858.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1790290861.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1790608554.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94056","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1790759113.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1791401562.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1791403476.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-94054","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-94054","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94054","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8834-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-94055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-94056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-94057","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-94054","description":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.","status":"published","published":"2026-09-19T22:46:24.545Z","modified":"2026-09-22T16:07:39.291Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:19:53.786088Z"}],"euvd":[{"id":"EUVD-2026-83612","description":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.","status":"published","published":"2026-09-19T22:46:24Z","modified":"2026-09-22T16:07:39Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T17:28:02.601428Z"}],"ghsa":[{"id":"GHSA-r24f-7cqq-88w4","title":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of...","description":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.","status":"published","published":"2026-09-20T00:30:24Z","modified":"2026-09-20T00:30:33Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:12:14.055197Z"}],"nvd":[{"id":"CVE-2026-94054","description":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.","status":"published","published":"2026-09-19T23:17:10.827Z","modified":"2026-09-24T20:47:34.84Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:50.043898Z"}],"osv":[{"id":"DEBIAN-CVE-2026-94054","description":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.","status":"published","published":"2026-09-19T23:17:10.827Z","modified":"2026-09-27T21:00:08.173816922Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:06.846102Z"},{"id":"UBUNTU-CVE-2026-94054","description":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.","status":"published","published":"2026-09-19T23:17:00Z","modified":"2026-09-28T17:30:07.005399132Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"CLSA-2026-1790254810","title":"exim: Fix of 2 CVEs","description":"- CVE-2026-94054: fix out-of-bounds read in Proxy Protocol v1 header parsing\n- CVE-2026-94057: avoid more SMTP smuggling attack types by honouring strict\n  CRLF mode when swallowing input after a data-phase rejection","status":"published","published":"2026-09-24T13:00:22Z","modified":"2026-10-26T09:30:51.499261714Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790290858","title":"exim: Fix of CVE-2026-94054","description":"- CVE-2026-94054: in proxy_protocol_setup(), size the copy of the PROXY v1\n  header line by its own NUL-terminated length instead of the raw byte count\n  read from the socket, so the following memchr() cannot read past the\n  allocation and the CR terminator cannot be written outside it","status":"published","published":"2026-09-24T23:01:08Z","modified":"2026-10-26T09:31:51.518199158Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790290861","title":"exim: Fix of CVE-2026-94054","description":"- CVE-2026-94054: in proxy_protocol_setup(), size the copy of the PROXY v1\n  header line by its own NUL-terminated length instead of the raw byte count\n  read from the socket, so the following memchr() cannot read past the\n  allocation and the CR terminator cannot be written outside it","status":"published","published":"2026-09-24T23:01:11Z","modified":"2026-10-26T09:31:43.909480644Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790608554","title":"Fix CVE(s): CVE-2026-94054, CVE-2026-94056","description":"   * SECURITY UPDATE: uninitialised stack data use in Proxy Protocol v2\n     - debian/patches/CVE-2026-94056.patch: repeat reads until the complete\n       16-byte PROXY v2 header, including the length field, has been\n       received, and abort if the peer closes before that.\n     - CVE-2026-94056","status":"published","published":"2026-09-28T15:16:07Z","modified":"2026-10-26T09:32:03.824661199Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790759113","title":"exim: Fix of 2 CVEs","description":"- CVE-2026-94054: recompute the PROXY protocol v1 header length from the copied\n  line in proxy_protocol_host(), so the following memchr() and end-of-line store\n  cannot read or write past the allocation\n- CVE-2026-94057: make read_message_data_smtp() honour the strict-CRLF state of\n  the current message when receive_swallow_smtp() drains input after a DATA\n  rejection, preventing further SMTP smuggling variants","status":"published","published":"2026-09-30T09:05:25Z","modified":"2026-10-26T09:31:35.725447481Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791401562","title":"exim: Fix of CVE-2026-94054","description":"- CVE-2026-94054: fix out-of-bounds read and write in the PROXY protocol v1 header parser","status":"published","published":"2026-10-08T22:01:50Z","modified":"2026-10-26T09:31:48.766105153Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791403476","title":"Fix CVE(s): CVE-2026-94054, CVE-2026-94056","description":"   * SECURITY UPDATE: out-of-bounds access in Proxy-Protocol v1 header\n     parsing with an attacker-controlled proxy\n     - debian/patches/CVE-2026-94054.patch: set ret to the length of the\n       heap copy of the PROXY v1 line instead of adding the\n       swallow_until_crlf() count, so the memchr() for the CR stays\n       inside the copy\n     - CVE-2026-94054\n   * SECURITY UPDATE: uninitialised stack data read on a short\n     Proxy-Protocol v2 header from an attacker-controlled proxy\n     - debian/patches/CVE-2026-94056.patch: repeat the read of the v2\n       length fields until all 16 header octets have arrived, and abort\n       on EOF or error instead of using uninitialised length data\n     - CVE-2026-94056","status":"published","published":"2026-10-07T20:04:49Z","modified":"2026-10-26T09:31:40.200035495Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-94054","title":"CVE-2026-94054 in exim4 - Patched by Root","description":"Root has patched CVE-2026-94054 in the exim4 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-28T10:36:59Z","modified":"2026-09-28T11:15:03.835968811Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-94054","title":"CVE-2026-94054 in exim4 - Patched by Root","description":"Root has patched CVE-2026-94054 in the exim4 package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-28T07:07:23Z","modified":"2026-10-08T13:00:07.32706799Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"USN-8834-1","title":"exim4 vulnerabilities","description":"It was discovered that Exim had an out-of-bounds write when\nProxy-Protocol was used with an attacker-controlled proxy. A remote\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2026-94054)\n\nIt was discovered that Exim had a use-after-free when certain\nnon-default TLS settings were used with GnuTLS. A remote attacker\ncould possibly use this issue to cause Exim to crash, resulting in\na denial of service. This issue only affected Ubuntu 26.04 LTS.\n(CVE-2026-94055)\n\nIt was discovered that Exim allowed attackers to read uninitialized\ndata from stack memory when Proxy-Protocol was used with an\nattacker-controlled proxy. A remote attacker could possibly use this\nissue to obtain sensitive information. (CVE-2026-94056)\n\nIt was discovered that Exim allowed SMTP smuggling via crafted data\nsent after a rejection during DATA processing. A remote attacker\ncould possibly use this issue to inject arbitrary email messages.\n(CVE-2026-94057)","status":"published","published":"2026-09-28T12:05:13Z","modified":"2026-09-28T17:42:48.49123807Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}