This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Exim fixes four vulnerabilities
Exim version 4.100.1 fixes four vulnerabilities, two of which are high-severity. The most severe ones are described below; all of them can be found at [1].
An unauthenticated remote attacker can, when Proxy Protocol (v2) is used with an attacker-controlled proxy, read some uninitialized data from the stack [1][2].
The vulnerability is present in product:
- Exim; >=4.83, <=4.100;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L
More information:
- CVE-2026-94056 at cve.org, NVD
- CWE-908: Use of Uninitialized Resource at cwe.mitre.org
The vulnerability was publicly disclosed 18. 9. 2026.
An unauthenticated remote attacker can, when Proxy Protocol (v1) is used with an attacker-controlled proxy, write a null byte past the boundary of allocated heap memory and thereby corrupt the heap [1][3].
The vulnerability is present in product:
- Exim; >=4.83, <=4.100;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
More information:
- CVE-2026-94054 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 18. 9. 2026.
An unauthenticated remote attacker can, under certain conditions, perform SMTP smuggling, i.e. deliver through the vulnerable server a message that the sending server did not actually send or log [1][4].
The vulnerability is present in product:
- Exim; <4.100.1;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
More information:
- CVE-2026-94057 at cve.org, NVD
- CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 18. 9. 2026.
Links
By CESNET, z.s.p.o. Michaela Ručková on 22. 9. 2026.