{"id":"CVE-2026-94056","aliases":["CLSA-2026-1790608554","CLSA-2026-1790608989","CLSA-2026-1790609038","CLSA-2026-1790870694","CLSA-2026-1791403476","CLSA-2026-1791831177","DEBIAN-CVE-2026-94056","EUVD-2026-83614","GHSA-xcfp-8rjq-j39w","ROOT-OS-DEBIAN-12-CVE-2026-94056","ROOT-OS-DEBIAN-13-CVE-2026-94056","UBUNTU-CVE-2026-94056","USN-8834-1"],"status":"published","title":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows...","description":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00238,"percentile":0.15019,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-908"],"published":"2026-09-19T22:52:43Z","modified":"2026-10-26T09:32:03Z","fixes":[{"ecosystem":"TuxCare:CentOS:8.4","package":"exim","fixed_in":["4.99.5-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"exim-greylist","fixed_in":["4.99.5-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"exim-mon","fixed_in":["4.99.5-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"exim-mysql","fixed_in":["4.99.5-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"exim-pgsql","fixed_in":["4.99.5-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"exim","fixed_in":["4.99.5-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"exim-greylist","fixed_in":["4.99.5-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"exim-mon","fixed_in":["4.99.5-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"exim-mysql","fixed_in":["4.99.5-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"exim-pgsql","fixed_in":["4.99.5-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim","fixed_in":["4.99.5-1.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-greylist","fixed_in":["4.99.5-1.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-mon","fixed_in":["4.99.5-1.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-mysql","fixed_in":["4.99.5-1.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-pgsql","fixed_in":["4.99.5-1.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim","fixed_in":["4.99.5-1.el9_2.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-greylist","fixed_in":["4.99.5-1.el9_2.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-mon","fixed_in":["4.99.5-1.el9_2.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-mysql","fixed_in":["4.99.5-1.el9_2.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-pgsql","fixed_in":["4.99.5-1.el9_2.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"exim4","fixed_in":["4.98.2-1+deb13u5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"exim4","fixed_in":["4.100.1-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"exim4","fixed_in":["4.96-15+deb12u10.aikido.4"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-exim4","fixed_in":["4.96-15+deb12u10.aikido.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"exim4","fixed_in":["4.95-4ubuntu2.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"exim4","fixed_in":["4.97-4ubuntu4.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"exim4","fixed_in":["4.99.1-1ubuntu1.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-daemon-heavy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-daemon-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exim4-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"eximon4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-daemon-heavy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-daemon-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"exim4-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"eximon4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.100-1","4.100-1~bpo13+1","4.100-3","4.100-4","4.100.1-1","4.100.1-1~bpo13+1","4.100.1-2","4.100~RC1-1","4.100~RC2-1","4.100~RC3-1","4.100~RC3-2","4.96-15","4.96-15+deb12u1","4.96-15+deb12u10","4.96-15+deb12u2","4.96-15+deb12u3","4.96-15+deb12u4","4.96-15+deb12u5","4.96-15+deb12u6","4.96-15+deb12u7","4.96-15+deb12u8","4.96-15+deb12u9","4.96-16","4.96-17","4.96-18","4.96-19","4.96-20","4.96-21","4.96-22","4.97-1","4.97-1~hurd.2","4.97-2","4.97-3","4.97-4","4.97-5","4.97-6","4.97-7","4.97-8","4.97-8~bpo12+1","4.97~RC0-1","4.97~RC0-2","4.97~RC0-3","4.97~RC1-1","4.97~RC1-2","4.97~RC2-1","4.97~RC2-2","4.97~RC3-1","4.98-1","4.98-1~bpo12+1","4.98-2","4.98-2~bpo12+1","4.98-3","4.98-3+hurd.1","4.98-3~bpo12+1","4.98-4","4.98.1-1","4.98.1-2","4.98.1-2~bpo12+1","4.98.2-1","4.98.2-1+hurd.1","4.98.2-1~bpo12+1","4.98.2-2","4.98~RC0-1","4.98~RC1-1","4.98~RC2-1","4.98~RC3-1","4.98~RC3-2","4.98~RC3-2~bpo12+1","4.99-1","4.99-2","4.99-3","4.99-4","4.99-4~bpo13+1","4.99-5","4.99-6","4.99-6~bpo13+1","4.99-7","4.99-7~bpo13+1","4.99.1-1","4.99.1-1~bpo13+1","4.99.1-2","4.99.1-3","4.99.1-4","4.99.1-5","4.99.1-6","4.99.2-1","4.99.2-1~bpo13+1","4.99.2-2","4.99.2-2~bpo13+1","4.99.3-1","4.99.3-2","4.99.3-2~bpo13+1","4.99.4-1","4.99.4-1~bpo13+1","4.99.4-2","4.99.4-2~bpo13+1","4.99~RC1-1","4.99~RC2-1","4.99~RC3-1","4.99~RC3-2"]},{"source":"osv","ecosystem":"Debian:13","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-1+deb13u5"}]}],"versions":["4.98.2-1","4.98.2-1+deb13u1","4.98.2-1+deb13u2","4.98.2-1+deb13u3","4.98.2-1+deb13u4"]},{"source":"osv","ecosystem":"Debian:14","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.100.1-1"}]}],"versions":["4.100-1","4.100-1~bpo13+1","4.100-3","4.100-4","4.100.1-1~bpo13+1","4.100~RC1-1","4.100~RC2-1","4.100~RC3-1","4.100~RC3-2","4.98.2-1","4.98.2-1+hurd.1","4.98.2-2","4.99-1","4.99-2","4.99-3","4.99-4","4.99-4~bpo13+1","4.99-5","4.99-6","4.99-6~bpo13+1","4.99-7","4.99-7~bpo13+1","4.99.1-1","4.99.1-1~bpo13+1","4.99.1-2","4.99.1-3","4.99.1-4","4.99.1-5","4.99.1-6","4.99.2-1","4.99.2-1~bpo13+1","4.99.2-2","4.99.2-2~bpo13+1","4.99.3-1","4.99.3-2","4.99.3-2~bpo13+1","4.99.4-1","4.99.4-1~bpo13+1","4.99.4-2","4.99.4-2~bpo13+1","4.99~RC1-1","4.99~RC2-1","4.99~RC3-1","4.99~RC3-2"]},{"source":"osv","ecosystem":"Root:Debian:12","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.96-15+deb12u10.aikido.4"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.96-15+deb12u10.aikido.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.80-7ubuntu3","4.80-7ubuntu4","4.80-9ubuntu1","4.80-9ubuntu2","4.82-3ubuntu1","4.82-3ubuntu2","4.82-3ubuntu2.1","4.82-3ubuntu2.2","4.82-3ubuntu2.3","4.82-3ubuntu2.4","4.82-3ubuntu2.4+esm1","4.82-3ubuntu2.4+esm2","4.82-3ubuntu2.4+esm3","4.82-3ubuntu2.4+esm4","4.82-3ubuntu2.4+esm6","4.82-3ubuntu2.4+esm7","4.82-3ubuntu2.4+esm8","4.82-3ubuntu2.4+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.86-3ubuntu1","4.86-7ubuntu1","4.86-7ubuntu2","4.86-7ubuntu3","4.86.2-2ubuntu1","4.86.2-2ubuntu2","4.86.2-2ubuntu2.1","4.86.2-2ubuntu2.2","4.86.2-2ubuntu2.3","4.86.2-2ubuntu2.4","4.86.2-2ubuntu2.5","4.86.2-2ubuntu2.6","4.86.2-2ubuntu2.6+esm1","4.86.2-2ubuntu2.6+esm2","4.86.2-2ubuntu2.6+esm4","4.86.2-2ubuntu2.6+esm5","4.86.2-2ubuntu2.6+esm6","4.86.2-2ubuntu2.6+esm7","4.86.2-2ubuntu2.6+esm8","4.86.2-2ubuntu2.6+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.89-5ubuntu1","4.89-9ubuntu1","4.89-9ubuntu2","4.89-9ubuntu3","4.89-9ubuntu4","4.90.1-1ubuntu1","4.90.1-1ubuntu1.1","4.90.1-1ubuntu1.2","4.90.1-1ubuntu1.3","4.90.1-1ubuntu1.4","4.90.1-1ubuntu1.5","4.90.1-1ubuntu1.8","4.90.1-1ubuntu1.9","4.90.1-1ubuntu1.10","4.90.1-1ubuntu1.10+esm1","4.90.1-1ubuntu1.10+esm2","4.90.1-1ubuntu1.10+esm3","4.90.1-1ubuntu1.10+esm4","4.90.1-1ubuntu1.10+esm5","4.90.1-1ubuntu1.10+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.92.1-1ubuntu3","4.92.1-1ubuntu4","4.93~RC2-1ubuntu1","4.93-9ubuntu1","4.93-11ubuntu1","4.93-12ubuntu1","4.93-13ubuntu1","4.93-13ubuntu1.1","4.93-13ubuntu1.5","4.93-13ubuntu1.6","4.93-13ubuntu1.7","4.93-13ubuntu1.8","4.93-13ubuntu1.9","4.93-13ubuntu1.10","4.93-13ubuntu1.11","4.93-13ubuntu1.12","4.93-13ubuntu1.12+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.95-4ubuntu2.12"}]}],"versions":["4.94.2-7ubuntu2","4.95-2ubuntu2","4.95-4ubuntu1","4.95-4ubuntu2","4.95-4ubuntu2.1","4.95-4ubuntu2.2","4.95-4ubuntu2.3","4.95-4ubuntu2.4","4.95-4ubuntu2.5","4.95-4ubuntu2.6","4.95-4ubuntu2.7","4.95-4ubuntu2.8","4.95-4ubuntu2.9","4.95-4ubuntu2.10","4.95-4ubuntu2.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97-4ubuntu4.8"}]}],"versions":["4.96-17ubuntu2","4.96-17ubuntu2.1","4.97-3ubuntu1","4.97-4ubuntu1","4.97-4ubuntu3","4.97-4ubuntu4","4.97-4ubuntu4.1","4.97-4ubuntu4.2","4.97-4ubuntu4.3","4.97-4ubuntu4.4","4.97-4ubuntu4.5","4.97-4ubuntu4.6","4.97-4ubuntu4.7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1ubuntu1.5"}]}],"versions":["4.98.2-1ubuntu2","4.99-4ubuntu1","4.99.1-1ubuntu1","4.99.1-1ubuntu1.1","4.99.1-1ubuntu1.2","4.99.1-1ubuntu1.3","4.99.1-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.95-4ubuntu2.12"}]}],"versions":["4.94.2-7ubuntu2","4.95-2ubuntu2","4.95-4ubuntu1","4.95-4ubuntu2","4.95-4ubuntu2.1","4.95-4ubuntu2.2","4.95-4ubuntu2.3","4.95-4ubuntu2.4","4.95-4ubuntu2.5","4.95-4ubuntu2.6","4.95-4ubuntu2.7","4.95-4ubuntu2.8","4.95-4ubuntu2.9","4.95-4ubuntu2.10","4.95-4ubuntu2.11"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97-4ubuntu4.8"}]}],"versions":["4.96-17ubuntu2","4.96-17ubuntu2.1","4.97-3ubuntu1","4.97-4ubuntu1","4.97-4ubuntu3","4.97-4ubuntu4","4.97-4ubuntu4.1","4.97-4ubuntu4.2","4.97-4ubuntu4.3","4.97-4ubuntu4.4","4.97-4ubuntu4.5","4.97-4ubuntu4.6","4.97-4ubuntu4.7"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1ubuntu1.5"}]}],"versions":["4.98.2-1ubuntu2","4.99-4ubuntu1","4.99.1-1ubuntu1","4.99.1-1ubuntu1.1","4.99.1-1ubuntu1.2","4.99.1-1ubuntu1.3","4.99.1-1ubuntu1.4"],"bundled":4}],"products":[{"vendor":"exim","product":"exim"}],"references":[{"url":"https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html","tags":["Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94056","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xcfp-8rjq-j39w"},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1790608554.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94054","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1790608989.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1790609038.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1790870694.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1791403476.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791831177.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-94056","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-94056","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94056","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8834-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-94054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-94055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-94057","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-94056","description":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.","status":"published","published":"2026-09-19T22:52:43.612Z","modified":"2026-09-21T18:32:49.509Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:19:53.786088Z"}],"euvd":[{"id":"EUVD-2026-83614","description":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.","status":"published","published":"2026-09-19T22:52:43Z","modified":"2026-09-21T18:32:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T17:28:04.588371Z"}],"ghsa":[{"id":"GHSA-xcfp-8rjq-j39w","title":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows...","description":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.","status":"published","published":"2026-09-20T00:30:24Z","modified":"2026-09-20T00:30:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L","level":"high"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T15:12:13.368323Z"}],"nvd":[{"id":"CVE-2026-94056","description":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.","status":"published","published":"2026-09-19T23:17:11.113Z","modified":"2026-09-24T20:45:30.12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:12:50.043898Z"}],"osv":[{"id":"DEBIAN-CVE-2026-94056","description":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.","status":"published","published":"2026-09-19T23:17:11.113Z","modified":"2026-09-27T21:00:08.172086587Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:06.846102Z"},{"id":"UBUNTU-CVE-2026-94056","description":"Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.","status":"published","published":"2026-09-19T23:17:00Z","modified":"2026-09-28T17:30:07.003358884Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"CLSA-2026-1790608554","title":"Fix CVE(s): CVE-2026-94054, CVE-2026-94056","description":"   * SECURITY UPDATE: uninitialised stack data use in Proxy Protocol v2\n     - debian/patches/CVE-2026-94056.patch: repeat reads until the complete\n       16-byte PROXY v2 header, including the length field, has been\n       received, and abort if the peer closes before that.\n     - CVE-2026-94056","status":"published","published":"2026-09-28T15:16:07Z","modified":"2026-10-26T09:32:03.824661199Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790608989","title":"exim: Fix of CVE-2026-94056","description":"- CVE-2026-94056: repeat the PROXYv2 header read until all 16 octets have\n  arrived, so the length field is never taken from uninitialised memory","status":"published","published":"2026-09-28T15:23:21Z","modified":"2026-10-26T09:31:44.158681891Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790609038","title":"exim: Fix of CVE-2026-94056","description":"- CVE-2026-94056: repeat the PROXYv2 header read until all 16 octets have\n  arrived, so the length field is never taken from uninitialised memory","status":"published","published":"2026-09-28T15:24:09Z","modified":"2026-10-26T09:31:51.377051081Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790870694","title":"exim: Fix of CVE-2026-94056","description":"- CVE-2026-94056: loop until the full 16-octet PROXY protocol v2 header has been\n  read in proxy_protocol_setup(), so a short read cannot leave the header length\n  field uninitialised","status":"published","published":"2026-10-01T16:05:07Z","modified":"2026-10-26T09:31:36.64778633Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791403476","title":"Fix CVE(s): CVE-2026-94054, CVE-2026-94056","description":"   * SECURITY UPDATE: out-of-bounds access in Proxy-Protocol v1 header\n     parsing with an attacker-controlled proxy\n     - debian/patches/CVE-2026-94054.patch: set ret to the length of the\n       heap copy of the PROXY v1 line instead of adding the\n       swallow_until_crlf() count, so the memchr() for the CR stays\n       inside the copy\n     - CVE-2026-94054\n   * SECURITY UPDATE: uninitialised stack data read on a short\n     Proxy-Protocol v2 header from an attacker-controlled proxy\n     - debian/patches/CVE-2026-94056.patch: repeat the read of the v2\n       length fields until all 16 header octets have arrived, and abort\n       on EOF or error instead of using uninitialised length data\n     - CVE-2026-94056","status":"published","published":"2026-10-07T20:04:49Z","modified":"2026-10-26T09:31:40.200035495Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791831177","title":"exim: Fix of CVE-2026-94056","description":"- CVE-2026-94056: read the full Proxy Protocol v2 header before using its\n  length field, avoiding use of uninitialised stack data","status":"published","published":"2026-10-12T18:53:07Z","modified":"2026-10-26T09:30:15.692937115Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-94056","title":"CVE-2026-94056 in exim4 - Patched by Root","description":"Root has patched CVE-2026-94056 in the exim4 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-28T10:36:59Z","modified":"2026-09-28T11:15:03.368629594Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-94056","title":"CVE-2026-94056 in exim4 - Patched by Root","description":"Root has patched CVE-2026-94056 in the exim4 package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-28T07:07:23Z","modified":"2026-10-08T13:00:07.280468926Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"USN-8834-1","title":"exim4 vulnerabilities","description":"It was discovered that Exim had an out-of-bounds write when\nProxy-Protocol was used with an attacker-controlled proxy. A remote\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2026-94054)\n\nIt was discovered that Exim had a use-after-free when certain\nnon-default TLS settings were used with GnuTLS. A remote attacker\ncould possibly use this issue to cause Exim to crash, resulting in\na denial of service. This issue only affected Ubuntu 26.04 LTS.\n(CVE-2026-94055)\n\nIt was discovered that Exim allowed attackers to read uninitialized\ndata from stack memory when Proxy-Protocol was used with an\nattacker-controlled proxy. A remote attacker could possibly use this\nissue to obtain sensitive information. (CVE-2026-94056)\n\nIt was discovered that Exim allowed SMTP smuggling via crafted data\nsent after a rejection during DATA processing. A remote attacker\ncould possibly use this issue to inject arbitrary email messages.\n(CVE-2026-94057)","status":"published","published":"2026-09-28T12:05:13Z","modified":"2026-09-28T17:42:48.49123807Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}