CVE-2026-94057: CRLF Injection
Published Sep 19, 2026
·Updated
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.
Affected Software
1 affected component
Exim Exim<4.100.1
Event History
Sep 19, 2026
CVE Published
via MITRE·10:55 PM
Data Sourced
via MITRE·10:55 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which Exim versions are affected?
Exim versions before 4.100.1 are affected. Systems running 4.100.1 or later are not identified as affected by the provided data.
2
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network-based exploitation with no privileges required and no user interaction, although attack complexity is rated high.
3
What impact is indicated by the CVSS vector?
The vector indicates low integrity impact, with no confidentiality or availability impact. It also indicates that the impact may cross a security authority boundary, as reflected by Scope: Changed.