PT-2026-36195 · Exim · Exim

Bernard Quatermass · Published 2026-04-30 · Updated 2026-05-04 · CVE-2026-40684

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Exim versions prior to 4.99.2

Description On systems using musl libc (instead of glibc), an attacker can crash the connection instance by providing malformed DNS data in PTR records. This issue stems from an oddity in octal printing within the dn expand() function.

Recommendations Update to version 4.99.2 or later.

Fix

DoS

Weakness Enumeration

CWE-684

Related Identifiers

CVE-2026-40684

Affected Products

Exim

References · 17

• https://code.exim.org/exim/exim/commit/628bbaca7672748d941a12e7cd5f0122a4e18c81 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40684 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40684 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-40684 · Vendor Advisory
• https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40684.assessment · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2049972642497585165 · Twitter Post
• https://exim.org/static/doc/security/CVE-2026-40684.txt · Note
• https://exim.org/static/doc/security/CVE-2025-40684.txt · Note
• https://t.me/cveNotify/161678 · Telegram Post
• https://twitter.com/dnsaudit/status/2050653888357789905 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/01/11 · Note
• https://twitter.com/CVEnew/status/2049970638929175027 · Twitter Post
• https://reddit.com/r/cpanel/comments/1t3qd0y/first_cpanel_then_kernel_and_now_exim · Reddit Post
• https://t.me/CVEtracker/52355 · Telegram Post
• https://openwall.com/lists/oss-security/2026/04/30/21 · Note