Summary
Timo Longin discovered that Exim incorrectly handled certain SMTP messages
in PIPELINING/CHUNKING configurations. A remote attacker could possibly use
this issue to perform SMTP smuggling. This issue only affected Ubuntu
14.04 LTS. (CVE-2023-51766)
It was discovered that Exim incorrectly handled certain malformed JSON
data in headers. A remote attacker could possibly use this issue to crash
Exim, resulting in a denial of service, or execute arbitrary code. This
issue only affected Ubuntu 20.04 LTS. (CVE-2026-40685)
It was discovered that Exim incorrectly handled certain malformed UTF-8
headers. A remote attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 20.04 LTS.
(CVE-2026-40686)
It was discovered that Exim incorrectly handled certain SPA resources.
A remote attacker could possibly use this issue to crash Exim, resulting in
a denial of service, or obtain sensitive information. This issue only
affected Ubuntu 20.04 LTS. (CVE-2026-40687)
It was discovered that Exim incorrectly handled certain CHUNKING
transfers in some GnuTLS configurations. A remote attacker could possibly
use this issue to crash Exim, resulting in a denial of service, or execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-45185)
Warisjeet Singh discovered that Exim incorrectly handled certain proxy
connections in builds with proxy support enabled. A remote attacker could
possibly use this issue to obtain sensitive information. This issue only
affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-48840)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | exim4 | 4.82-3ubuntu2.4+esm9 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | exim4 | 4.86.2-2ubuntu2.6+esm9 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | exim4 | 4.90.1-1ubuntu1.10+esm6 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | exim4 | 4.93-13ubuntu1.12+esm1 |
Vulnerabilities 6
-
Critical 9.8CVE-2026-45185 Public exploit
Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing …
-
Medium 6.5
In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounte…
-
Medium 5.3
Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of unin…
-
Medium 4.8
In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out…
-
Low 3.7
In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characte…
-
Unscored —
Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a publ…