CVE-2025-26794: Exim: CVE-2025-26794: upcoming security lease
Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eximto a version that resolves this vulnerability.Fixed in 4.98.1Patch CVE-2025-26794
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26794?
CVE-2025-26794 is considered a critical vulnerability due to its potential for remote SQL injection.
How do I fix CVE-2025-26794?
To fix CVE-2025-26794, upgrade Exim to version 4.98.1 or later.
Which versions of Exim are affected by CVE-2025-26794?
CVE-2025-26794 affects Exim versions prior to 4.98.1.
What is the impact of CVE-2025-26794?
The impact of CVE-2025-26794 includes the potential for unauthorized access to the database through SQL injection vulnerabilities.
Can CVE-2025-26794 be exploited remotely?
Yes, CVE-2025-26794 can be exploited remotely, allowing attackers to execute malicious SQL queries.