{"id":"CVE-2026-94055","aliases":["DEBIAN-CVE-2026-94055","EUVD-2026-83613","GHSA-jpgj-v2p6-hc2c","UBUNTU-CVE-2026-94055","USN-8834-1"],"status":"published","title":"Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after...","description":"Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00286,"percentile":0.21416,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-09-19T22:48:57Z","modified":"2026-09-28T17:42:48Z","fixes":[{"ecosystem":"Debian:14","package":"exim4","fixed_in":["4.100.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"exim4","fixed_in":["4.99.1-1ubuntu1.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:14","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.100.1-1"}]}],"versions":["4.100-1","4.100-1~bpo13+1","4.100-3","4.100-4","4.100~RC1-1","4.100~RC2-1","4.100~RC3-1","4.100~RC3-2","4.98.2-1","4.98.2-1+hurd.1","4.98.2-2","4.99-1","4.99-2","4.99-3","4.99-4","4.99-4~bpo13+1","4.99-5","4.99-6","4.99-6~bpo13+1","4.99-7","4.99-7~bpo13+1","4.99.1-1","4.99.1-1~bpo13+1","4.99.1-2","4.99.1-3","4.99.1-4","4.99.1-5","4.99.1-6","4.99.2-1","4.99.2-1~bpo13+1","4.99.2-2","4.99.2-2~bpo13+1","4.99.3-1","4.99.3-2","4.99.3-2~bpo13+1","4.99.4-1","4.99.4-1~bpo13+1","4.99.4-2","4.99.4-2~bpo13+1","4.99~RC1-1","4.99~RC2-1","4.99~RC3-1","4.99~RC3-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1ubuntu1.5"}]}],"versions":["4.98.2-1ubuntu2","4.99-4ubuntu1","4.99.1-1ubuntu1","4.99.1-1ubuntu1.1","4.99.1-1ubuntu1.2","4.99.1-1ubuntu1.3","4.99.1-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.95-4ubuntu2.12"}]}],"versions":["4.94.2-7ubuntu2","4.95-2ubuntu2","4.95-4ubuntu1","4.95-4ubuntu2","4.95-4ubuntu2.1","4.95-4ubuntu2.2","4.95-4ubuntu2.3","4.95-4ubuntu2.4","4.95-4ubuntu2.5","4.95-4ubuntu2.6","4.95-4ubuntu2.7","4.95-4ubuntu2.8","4.95-4ubuntu2.9","4.95-4ubuntu2.10","4.95-4ubuntu2.11"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97-4ubuntu4.8"}]}],"versions":["4.96-17ubuntu2","4.96-17ubuntu2.1","4.97-3ubuntu1","4.97-4ubuntu1","4.97-4ubuntu3","4.97-4ubuntu4","4.97-4ubuntu4.1","4.97-4ubuntu4.2","4.97-4ubuntu4.3","4.97-4ubuntu4.4","4.97-4ubuntu4.5","4.97-4ubuntu4.6","4.97-4ubuntu4.7"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1ubuntu1.5"}]}],"versions":["4.98.2-1ubuntu2","4.99-4ubuntu1","4.99.1-1ubuntu1","4.99.1-1ubuntu1.1","4.99.1-1ubuntu1.2","4.99.1-1ubuntu1.3","4.99.1-1ubuntu1.4"],"bundled":4}],"products":[{"vendor":"exim","product":"exim"}],"references":[{"url":"https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html","tags":["Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94055"},{"url":"https://github.com/advisories/GHSA-jpgj-v2p6-hc2c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-94055","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-94055","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94055","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8834-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-94054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-94056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-94057","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-94055","description":"Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.","status":"published","published":"2026-09-19T22:48:57.996Z","modified":"2026-09-21T15:19:07.403Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-83613","description":"Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.","status":"published","published":"2026-09-19T22:48:57Z","modified":"2026-09-21T15:19:07Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T17:28:05.36994Z"}],"ghsa":[{"id":"GHSA-jpgj-v2p6-hc2c","title":"Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after...","description":"Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.","status":"published","published":"2026-09-20T00:30:24Z","modified":"2026-09-20T00:30:32Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:12:13.368323Z"}],"nvd":[{"id":"CVE-2026-94055","description":"Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.","status":"published","published":"2026-09-19T23:17:10.973Z","modified":"2026-09-24T20:45:59.8Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:50.043898Z"}],"osv":[{"id":"DEBIAN-CVE-2026-94055","description":"Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.","status":"published","published":"2026-09-19T23:17:10.973Z","modified":"2026-09-27T11:00:07.942288702Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:46:06.846102Z"},{"id":"UBUNTU-CVE-2026-94055","description":"Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.","status":"published","published":"2026-09-19T23:17:00Z","modified":"2026-09-28T17:30:07.004383051Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"USN-8834-1","title":"exim4 vulnerabilities","description":"It was discovered that Exim had an out-of-bounds write when\nProxy-Protocol was used with an attacker-controlled proxy. A remote\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2026-94054)\n\nIt was discovered that Exim had a use-after-free when certain\nnon-default TLS settings were used with GnuTLS. A remote attacker\ncould possibly use this issue to cause Exim to crash, resulting in\na denial of service. This issue only affected Ubuntu 26.04 LTS.\n(CVE-2026-94055)\n\nIt was discovered that Exim allowed attackers to read uninitialized\ndata from stack memory when Proxy-Protocol was used with an\nattacker-controlled proxy. A remote attacker could possibly use this\nissue to obtain sensitive information. (CVE-2026-94056)\n\nIt was discovered that Exim allowed SMTP smuggling via crafted data\nsent after a rejection during DATA processing. A remote attacker\ncould possibly use this issue to inject arbitrary email messages.\n(CVE-2026-94057)","status":"published","published":"2026-09-28T12:05:13Z","modified":"2026-09-28T17:42:48.49123807Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}