CVE-2026-94057: CRLF Injection
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/exim4to a version that resolves this vulnerability.Fixed in 4.98.2-1+deb13u5Fixed in 4.100.1-1Fixed in 4.100.1-2 - Upgrade
Upgrade
Eximto a version that resolves this vulnerability.Fixed in 4.100.1
Event History
Frequently Asked Questions
Which Exim versions are affected?
Exim versions before 4.100.1 are affected. Systems running 4.100.1 or later are not identified as affected by the provided data.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network-based exploitation with no privileges required and no user interaction, although attack complexity is rated high.
What impact is indicated by the CVSS vector?
The vector indicates low integrity impact, with no confidentiality or availability impact. It also indicates that the impact may cross a security authority boundary, as reflected by Scope: Changed.