DEV Community

jeffrey
jeffrey

Posted on

Exim 4.100.1 Remediation Guide: Patching, Workarounds and Verification

#exim #vulnerability #mailserver #proxyprotocol

Exim 4.100.1 Remediation Guide: Patching, Workarounds and Verification

Vulnerability overview

On 18 September 2026 the Exim project published version 4.100.1, fixing four security defects: two High-severity Proxy Protocol bugs, a Low-severity GnuTLS use-after-free and a Medium-severity SMTP smuggling issue. The maintainers report no confirmed exploitation and no public proof-of-concept. The top CVSS score in the set is 7.5.

Mechanism and exploitation conditions

Proxy Protocol version 1 (High)

A remote attacker can read roughly 230 bytes past a heap allocation and perform a single NUL-byte write. A buggy or compromised proxy in front of Exim is required.

Proxy Protocol version 2 (High)

The version 2 parser leaks uninitialized stack data to the attacker, under the same proxy precondition.

GnuTLS use-after-free (Low)

This defect crashes a receive process, but only under the non-default TLS-on-connect setting with GnuTLS.

SMTP smuggling (Medium)

Crafted data placed after a rejection during the DATA phase lets an attacker deliver a message that differs from the one the sender logged.

Impact

The Proxy Protocol bugs expose adjacent heap or stack memory to a remote peer. The GnuTLS flaw interrupts mail acceptance by crashing the receive process. The smuggling flaw weakens the integrity guarantee that a delivered message matches the message sent.

Affected products and scope

The Proxy Protocol bugs and the SMTP smuggling issue affect Exim 4.83 through 4.100. The GnuTLS use-after-free affects Exim 4.98 through 4.100. Exim 4.100.1 is the fixed release.

Exposure context

ZoomEye returned 10,101,302 assets for app="Exim". The figure describes fingerprint matches, not confirmed vulnerable installations. A CVE-scoped query for vul.cve="CVE-2026-94055" returned no indexed results.

Remediation and mitigations

  1. Upgrade to Exim 4.100.1. Three of the four defects ship without a workaround, so patching is the direct path.
  2. For the GnuTLS defect alone, disable the non-default tls_early_banner_hosts option as a stopgap.
  3. Download the fixed release from the official Exim download mirror.
  4. Confirm the running version after upgrade and re-check any proxy layer that terminates connections before Exim, since both High-severity bugs assume a faulty or compromised proxy.
  5. Review message-integrity controls, because the smuggling flaw affects every version up to 4.100.

References

Top comments (0)