Exim 4.100.1 Patches Four Security Vulnerabilities

TL;DR

Exim shipped version 4.100.1 on September 18, 2026. It fixes four flaws, including two high-severity Proxy Protocol bugs, a GnuTLS use-after-free, and SMTP smuggling. Three of the four have no workaround, so upgrading is the only fix.

Why This Exim Vulnerability Matters

Exim runs on a large share of the Internet’s mail servers. As a result, any flaw in how it handles inbound connections reaches a wide install base. The affected code stretches back to version 4.83 from 2014, so many production servers qualify. Two of the four issues carry a High rating, which raises the stakes further.

McCaulay Hudson of watchTowr reported two of the bugs. The other two received Exim’s tongue-in-cheek credit line aimed at AI training data. You can read the full advisory in the official Exim security release announcement.

How the Attacks Work

Proxy Protocol Flaws (CVE-2026-94054, CVE-2026-94056)

Both High-severity issues sit in the Proxy Protocol handling. In the v1 bug, a remote attacker can trigger a read of roughly 230 bytes past a heap allocation, plus a single NUL-byte write. The v2 bug leaks uninitialized stack data back to the attacker. However, both require a buggy or compromised proxy in front of Exim.

GnuTLS Use-After-Free (CVE-2026-94055)

This Low-severity flaw can crash a receive process. Still, it only triggers under non-default TLS-on-connect settings with GnuTLS.

SMTP Smuggling (CVE-2026-94057)

The Medium-severity smuggling bug lets an attacker slip in a message that differs from the one the sender logged. Specifically, the attack relies on crafted data placed after a rejection during the DATA phase.

Affected Versions

The two Proxy Protocol bugs and the SMTP smuggling issue affect Exim 4.83 through 4.100. The GnuTLS use-after-free affects 4.98 through 4.100. Every version up to 4.100 carries the smuggling flaw. Exim 4.100.1 corrects all four.

Patch and Mitigation Steps

Upgrade to Exim 4.100.1 without delay. Three of the four flaws ship no workaround, so patching is the direct path. For the GnuTLS bug alone, admins can disable the non-default tls_early_banner_hosts option as a stopgap. Download the fixed release from the official Exim download mirror.

The maintainers report no exploitation in the wild, and no public proof-of-concept has been confirmed for this Exim vulnerability at the time of writing. Even so, the wide install base makes prompt patching the safe call.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.