{"id":"CVE-2026-94057","aliases":["CLSA-2026-1790254810","CLSA-2026-1790759113","DEBIAN-CVE-2026-94057","EUVD-2026-83615","GHSA-3mrg-v8x6-xfjw","UBUNTU-CVE-2026-94057","USN-8834-1"],"status":"published","title":"Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent...","description":"Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00197,"percentile":0.09485,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-93"],"published":"2026-09-19T22:55:00Z","modified":"2026-10-26T09:31:35Z","fixes":[{"ecosystem":"Debian:13","package":"exim4","fixed_in":["4.98.2-1+deb13u5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"exim4","fixed_in":["4.100.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"exim4","fixed_in":["4.95-4ubuntu2.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"exim4","fixed_in":["4.97-4ubuntu4.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"exim4","fixed_in":["4.99.1-1ubuntu1.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.5-1.el9.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.100-1","4.100-1~bpo13+1","4.100-3","4.100-4","4.100.1-1","4.100.1-1~bpo13+1","4.100.1-2","4.100~RC1-1","4.100~RC2-1","4.100~RC3-1","4.100~RC3-2","4.96-15","4.96-15+deb12u1","4.96-15+deb12u10","4.96-15+deb12u2","4.96-15+deb12u3","4.96-15+deb12u4","4.96-15+deb12u5","4.96-15+deb12u6","4.96-15+deb12u7","4.96-15+deb12u8","4.96-15+deb12u9","4.96-16","4.96-17","4.96-18","4.96-19","4.96-20","4.96-21","4.96-22","4.97-1","4.97-1~hurd.2","4.97-2","4.97-3","4.97-4","4.97-5","4.97-6","4.97-7","4.97-8","4.97-8~bpo12+1","4.97~RC0-1","4.97~RC0-2","4.97~RC0-3","4.97~RC1-1","4.97~RC1-2","4.97~RC2-1","4.97~RC2-2","4.97~RC3-1","4.98-1","4.98-1~bpo12+1","4.98-2","4.98-2~bpo12+1","4.98-3","4.98-3+hurd.1","4.98-3~bpo12+1","4.98-4","4.98.1-1","4.98.1-2","4.98.1-2~bpo12+1","4.98.2-1","4.98.2-1+hurd.1","4.98.2-1~bpo12+1","4.98.2-2","4.98~RC0-1","4.98~RC1-1","4.98~RC2-1","4.98~RC3-1","4.98~RC3-2","4.98~RC3-2~bpo12+1","4.99-1","4.99-2","4.99-3","4.99-4","4.99-4~bpo13+1","4.99-5","4.99-6","4.99-6~bpo13+1","4.99-7","4.99-7~bpo13+1","4.99.1-1","4.99.1-1~bpo13+1","4.99.1-2","4.99.1-3","4.99.1-4","4.99.1-5","4.99.1-6","4.99.2-1","4.99.2-1~bpo13+1","4.99.2-2","4.99.2-2~bpo13+1","4.99.3-1","4.99.3-2","4.99.3-2~bpo13+1","4.99.4-1","4.99.4-1~bpo13+1","4.99.4-2","4.99.4-2~bpo13+1","4.99~RC1-1","4.99~RC2-1","4.99~RC3-1","4.99~RC3-2"]},{"source":"osv","ecosystem":"Debian:13","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-1+deb13u5"}]}],"versions":["4.98.2-1","4.98.2-1+deb13u1","4.98.2-1+deb13u2","4.98.2-1+deb13u3","4.98.2-1+deb13u4"]},{"source":"osv","ecosystem":"Debian:14","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.100.1-1"}]}],"versions":["4.100-1","4.100-1~bpo13+1","4.100-3","4.100-4","4.100.1-1~bpo13+1","4.100~RC1-1","4.100~RC2-1","4.100~RC3-1","4.100~RC3-2","4.98.2-1","4.98.2-1+hurd.1","4.98.2-2","4.99-1","4.99-2","4.99-3","4.99-4","4.99-4~bpo13+1","4.99-5","4.99-6","4.99-6~bpo13+1","4.99-7","4.99-7~bpo13+1","4.99.1-1","4.99.1-1~bpo13+1","4.99.1-2","4.99.1-3","4.99.1-4","4.99.1-5","4.99.1-6","4.99.2-1","4.99.2-1~bpo13+1","4.99.2-2","4.99.2-2~bpo13+1","4.99.3-1","4.99.3-2","4.99.3-2~bpo13+1","4.99.4-1","4.99.4-1~bpo13+1","4.99.4-2","4.99.4-2~bpo13+1","4.99~RC1-1","4.99~RC2-1","4.99~RC3-1","4.99~RC3-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.80-7ubuntu3","4.80-7ubuntu4","4.80-9ubuntu1","4.80-9ubuntu2","4.82-3ubuntu1","4.82-3ubuntu2","4.82-3ubuntu2.1","4.82-3ubuntu2.2","4.82-3ubuntu2.3","4.82-3ubuntu2.4","4.82-3ubuntu2.4+esm1","4.82-3ubuntu2.4+esm2","4.82-3ubuntu2.4+esm3","4.82-3ubuntu2.4+esm4","4.82-3ubuntu2.4+esm6","4.82-3ubuntu2.4+esm7","4.82-3ubuntu2.4+esm8","4.82-3ubuntu2.4+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.86-3ubuntu1","4.86-7ubuntu1","4.86-7ubuntu2","4.86-7ubuntu3","4.86.2-2ubuntu1","4.86.2-2ubuntu2","4.86.2-2ubuntu2.1","4.86.2-2ubuntu2.2","4.86.2-2ubuntu2.3","4.86.2-2ubuntu2.4","4.86.2-2ubuntu2.5","4.86.2-2ubuntu2.6","4.86.2-2ubuntu2.6+esm1","4.86.2-2ubuntu2.6+esm2","4.86.2-2ubuntu2.6+esm4","4.86.2-2ubuntu2.6+esm5","4.86.2-2ubuntu2.6+esm6","4.86.2-2ubuntu2.6+esm7","4.86.2-2ubuntu2.6+esm8","4.86.2-2ubuntu2.6+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.89-5ubuntu1","4.89-9ubuntu1","4.89-9ubuntu2","4.89-9ubuntu3","4.89-9ubuntu4","4.90.1-1ubuntu1","4.90.1-1ubuntu1.1","4.90.1-1ubuntu1.2","4.90.1-1ubuntu1.3","4.90.1-1ubuntu1.4","4.90.1-1ubuntu1.5","4.90.1-1ubuntu1.8","4.90.1-1ubuntu1.9","4.90.1-1ubuntu1.10","4.90.1-1ubuntu1.10+esm1","4.90.1-1ubuntu1.10+esm2","4.90.1-1ubuntu1.10+esm3","4.90.1-1ubuntu1.10+esm4","4.90.1-1ubuntu1.10+esm5","4.90.1-1ubuntu1.10+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.92.1-1ubuntu3","4.92.1-1ubuntu4","4.93~RC2-1ubuntu1","4.93-9ubuntu1","4.93-11ubuntu1","4.93-12ubuntu1","4.93-13ubuntu1","4.93-13ubuntu1.1","4.93-13ubuntu1.5","4.93-13ubuntu1.6","4.93-13ubuntu1.7","4.93-13ubuntu1.8","4.93-13ubuntu1.9","4.93-13ubuntu1.10","4.93-13ubuntu1.11","4.93-13ubuntu1.12","4.93-13ubuntu1.12+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.95-4ubuntu2.12"}]}],"versions":["4.94.2-7ubuntu2","4.95-2ubuntu2","4.95-4ubuntu1","4.95-4ubuntu2","4.95-4ubuntu2.1","4.95-4ubuntu2.2","4.95-4ubuntu2.3","4.95-4ubuntu2.4","4.95-4ubuntu2.5","4.95-4ubuntu2.6","4.95-4ubuntu2.7","4.95-4ubuntu2.8","4.95-4ubuntu2.9","4.95-4ubuntu2.10","4.95-4ubuntu2.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97-4ubuntu4.8"}]}],"versions":["4.96-17ubuntu2","4.96-17ubuntu2.1","4.97-3ubuntu1","4.97-4ubuntu1","4.97-4ubuntu3","4.97-4ubuntu4","4.97-4ubuntu4.1","4.97-4ubuntu4.2","4.97-4ubuntu4.3","4.97-4ubuntu4.4","4.97-4ubuntu4.5","4.97-4ubuntu4.6","4.97-4ubuntu4.7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1ubuntu1.5"}]}],"versions":["4.98.2-1ubuntu2","4.99-4ubuntu1","4.99.1-1ubuntu1","4.99.1-1ubuntu1.1","4.99.1-1ubuntu1.2","4.99.1-1ubuntu1.3","4.99.1-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.95-4ubuntu2.12"}]}],"versions":["4.94.2-7ubuntu2","4.95-2ubuntu2","4.95-4ubuntu1","4.95-4ubuntu2","4.95-4ubuntu2.1","4.95-4ubuntu2.2","4.95-4ubuntu2.3","4.95-4ubuntu2.4","4.95-4ubuntu2.5","4.95-4ubuntu2.6","4.95-4ubuntu2.7","4.95-4ubuntu2.8","4.95-4ubuntu2.9","4.95-4ubuntu2.10","4.95-4ubuntu2.11"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97-4ubuntu4.8"}]}],"versions":["4.96-17ubuntu2","4.96-17ubuntu2.1","4.97-3ubuntu1","4.97-4ubuntu1","4.97-4ubuntu3","4.97-4ubuntu4","4.97-4ubuntu4.1","4.97-4ubuntu4.2","4.97-4ubuntu4.3","4.97-4ubuntu4.4","4.97-4ubuntu4.5","4.97-4ubuntu4.6","4.97-4ubuntu4.7"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99.1-1ubuntu1.5"}]}],"versions":["4.98.2-1ubuntu2","4.99-4ubuntu1","4.99.1-1ubuntu1","4.99.1-1ubuntu1.1","4.99.1-1ubuntu1.2","4.99.1-1ubuntu1.3","4.99.1-1ubuntu1.4"],"bundled":4}],"products":[{"vendor":"exim","product":"exim"}],"references":[{"url":"https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html","tags":["Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94057","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3mrg-v8x6-xfjw"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1790254810.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94054","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1790759113.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-94057","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-94057","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94057","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8834-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-94054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-94055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-94056","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-94057","description":"Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.","status":"published","published":"2026-09-19T22:55:00.348Z","modified":"2026-09-22T15:59:36.582Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:19:53.786088Z"}],"euvd":[{"id":"EUVD-2026-83615","description":"Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.","status":"published","published":"2026-09-19T22:55:00Z","modified":"2026-09-22T15:59:36Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:02.601428Z"}],"ghsa":[{"id":"GHSA-3mrg-v8x6-xfjw","title":"Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent...","description":"Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.","status":"published","published":"2026-09-20T00:30:24Z","modified":"2026-09-20T00:30:33Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:12:14.055197Z"}],"nvd":[{"id":"CVE-2026-94057","description":"Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.","status":"published","published":"2026-09-19T23:17:11.257Z","modified":"2026-09-24T20:40:10.563Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:12:50.043898Z"}],"osv":[{"id":"DEBIAN-CVE-2026-94057","description":"Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.","status":"published","published":"2026-09-19T23:17:11.257Z","modified":"2026-09-27T21:00:08.184563417Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:06.846102Z"},{"id":"UBUNTU-CVE-2026-94057","description":"Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.","status":"published","published":"2026-09-19T23:17:00Z","modified":"2026-09-28T17:30:07.159707305Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"CLSA-2026-1790254810","title":"exim: Fix of 2 CVEs","description":"- CVE-2026-94054: fix out-of-bounds read in Proxy Protocol v1 header parsing\n- CVE-2026-94057: avoid more SMTP smuggling attack types by honouring strict\n  CRLF mode when swallowing input after a data-phase rejection","status":"published","published":"2026-09-24T13:00:22Z","modified":"2026-10-26T09:30:51.499261714Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790759113","title":"exim: Fix of 2 CVEs","description":"- CVE-2026-94054: recompute the PROXY protocol v1 header length from the copied\n  line in proxy_protocol_host(), so the following memchr() and end-of-line store\n  cannot read or write past the allocation\n- CVE-2026-94057: make read_message_data_smtp() honour the strict-CRLF state of\n  the current message when receive_swallow_smtp() drains input after a DATA\n  rejection, preventing further SMTP smuggling variants","status":"published","published":"2026-09-30T09:05:25Z","modified":"2026-10-26T09:31:35.725447481Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"USN-8834-1","title":"exim4 vulnerabilities","description":"It was discovered that Exim had an out-of-bounds write when\nProxy-Protocol was used with an attacker-controlled proxy. A remote\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2026-94054)\n\nIt was discovered that Exim had a use-after-free when certain\nnon-default TLS settings were used with GnuTLS. A remote attacker\ncould possibly use this issue to cause Exim to crash, resulting in\na denial of service. This issue only affected Ubuntu 26.04 LTS.\n(CVE-2026-94055)\n\nIt was discovered that Exim allowed attackers to read uninitialized\ndata from stack memory when Proxy-Protocol was used with an\nattacker-controlled proxy. A remote attacker could possibly use this\nissue to obtain sensitive information. (CVE-2026-94056)\n\nIt was discovered that Exim allowed SMTP smuggling via crafted data\nsent after a rejection during DATA processing. A remote attacker\ncould possibly use this issue to inject arbitrary email messages.\n(CVE-2026-94057)","status":"published","published":"2026-09-28T12:05:13Z","modified":"2026-09-28T17:42:48.49123807Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}