Vulnerabilities

TI-2026-63294 CVE-2026-94057 · GHSA-3mrg-v8x6-xfjw

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match…

LOW 23

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00197 Published 2026-09-19 Fixed in 4.100.1 CWE-93

TI-2026-63293 CVE-2026-94056 · GHSA-xcfp-8rjq-j39w

Use of uninitialized resource in Exim

LOW 32

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00238 Published 2026-09-19 Fixed in 4.100.1 CWE-908

TI-2026-63292 CVE-2026-94055 · GHSA-jpgj-v2p6-hc2c

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.

LOW 24

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00286 Published 2026-09-19 Fixed in 4.100.1 CWE-416

TI-2026-63291 CVE-2026-94054 · GHSA-r24f-7cqq-88w4

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.

LOW 30

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.

CVSS 3.1HIGH 7.0 Network No auth No interaction EPSS 0.00268 Published 2026-09-19 Fixed in 4.100.1 CWE-787

Vulnerabilities

Filters

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match…

Use of uninitialized resource in Exim

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.