exim-4.99.4

[Bruce Dubbs]

New point version.

[Douglas R. Reno]

Dear Exim users and maintainers,

we are pleased to announce the availability of release 4.99.2 of Exim.

This is a security release.

It fixes the following vulnerabilities.

CVE-2026-40684     Possible crash with malicious DNS data when using musl libc

   On systems using musl libc (not glibc) due to an oddity in octal printing
   it is possible to crash the connection instance when malformed DNS data
   is present in PTR records.

CVE-2026-40685     Possible OOB read/write on corrupt JSON in header

   configurations using json operators on invalid externally-provided input
   could trigger heap corruption.

CVE-2026-40686     Possible OOB read with large UTF8 trailing characters

   configurations using utf8 operators on malformed utf8 in headers could
   trigger OOB reads and might trigger some data leak if error
   messages are required for subsequent emails in the current connection
   and similar malformed headers are present.

CVE-2026-40687     Possible OOB read/write with SPA authenticator

   in configurations using the SPA authentication driver to a hostile/compromised
   external SPA/NTLM connnection it is possible to trigger an OOB read/write
   and crash the connection instance or possibly leak heap data to the instance.

[Douglas R. Reno]

Now 4.99.3:

Hello,

The Exim maintainers are releasing an important security update to address a critical 
vulnerability affecting certain Exim configurations.

Vulnerability Details

A remotely reachable Use-After-Free (UAF) vulnerability has been identified in Exim's BDAT 
(binary data transmission) body parsing path when using the GnuTLS backend. This 
vulnerability can lead to heap corruption and potential code execution.

Affected Versions and Configurations

This vulnerability affects Exim versions 4.97 through 4.99.x that:
- Are built with GnuTLS support
- Have STARTTLS and CHUNKING advertised

Recommended Action

We strongly recommend all affected users upgrade to Exim 4.99.3 or later immediately.

Obtaining the Fix

Fixed versions are available:
- Repository: https://code.exim.org/exim-/exim (branch: exim-4.99+fixes, tag: exim-4.99.3) (signed by me)
- Tarballs: https://downloads.exim.org/exim4/ (signed by me)
- Please see the Exim website for detailed upgrade instructions

Additional Information

- Distros already have coordinated access to patches
- Internal tracking ID: EXIM-Security-2026-05-01.1
- Full technical details will be available: https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/

[Douglas R. Reno]

Now 4.99.4, with another fix:

Dear Exim users,

The Exim maintainers are releasing a security fix for CVE-2026-48840.

Identifier:   EXIM-Security-2026-05-19.1 (CVE-2026-48840)
Type:         pre-authentication information disclosure
Component:    Exim
Affects:      4.88 (2017) through the current 4.99.3 release
Corrected in: Exim 4.99.4 (exim-4.99.4)
Credit:       Warisjeet Singh (sin99xx)

Vulnerability Details
---------------------

proxy_protocol() declares hdr as an uninitialised stack union.  For a
PROXYv2 frame, the only length guard is an upper bound: the frame size
must not exceed sizeof(hdr).  No lower bound is checked.

A frame with address family 0x21 (TCPv6) and len=0 sets the read size
to 16, causing the read loop to copy exactly 0 bytes into the union.
The TCPv6 dispatch arm then unconditionally calls:

  memmove(tmpaddr6.sin6_addr.s6_addr, hdr.v2.addr.ip6.src_addr, 16)

copying 16 uninitialised stack bytes into tmpip6, which inet_ntop
formats as an IPv6 address string.  That string is written to
sender_host_address and emitted in the SMTP greeting banner:

  250 hostname Hello probe [::68ef:38ad:ffff:0]

The same defect affects family 0x11 (TCPv4) with len < 12 (4 leaked
bytes instead of 16).

The leaked bytes track ASLR entropy across daemon restarts and are
confirmed to be live userspace VA pointers, making this an
ASLR-defeat primitive usable as a chain component.

Fix: add minimum-length checks per address family (12 bytes for
TCPv4/0x11, 36 bytes for TCPv6/0x21) before the union is accessed.
Frames that fail the check are rejected with proxyfail, consistent
with all other malformed-frame handling in the function.

Reported by Warisjeet Singh (sin99xx).  Tested on aarch64 Linux;
architecture-independent (only leaked content varies).


Affected Configurations
-----------------------

Exim compiled with SUPPORT_PROXY (default in Debian, Ubuntu,
RHEL/Fedora packages) and hosts_proxy set to a non-empty value.
The attacker's source IP must match hosts_proxy, or the attacker
must be able to reach the port that expects a PROXY header through
a host already in hosts_proxy.


Mitigations
-----------

- Narrow hosts_proxy to the exact load-balancer IPs (not a CIDR superset).
- Unset hosts_proxy entirely to disable PROXY-protocol parsing on the affected listener.

Resolution
----------

Upgrade to Exim 4.99.4.  The fix is on branch exim-4.99+fixes,
tag exim-4.99.4, signed by Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de>,
key 0xDD98D92359DE9E3C2663F291697F0EDD68099F6F.

Downloads
---------

  https://ftp.exim.org/pub/exim/exim4/
  https://code.exim.org/exim/exim/releases

Advisory
--------

  https://www.exim.org/static/doc/security/EXIM-Security-2026-05-19.1/

Timeline
--------

  2026-05-19 12:35 UTC  Report received from Warisjeet Singh (sin99xx)
  2026-05-19 13:26 UTC  Acknowledgement sent to reporter
  2026-05-19 14:06 UTC  Root cause confirmed; fix drafted
  2026-05-25 13:30 UTC  CVE request submitted to Mitre via cveform.mitre.org
  2026-05-25 17:57 UTC  CVE-2026-48840 assigned by MITRE
  2026-05-26 00:41 UTC  Advance notice (distro-pre.txt) sent to distros@vs.openwall.org
  2026-05-26 00:47 UTC  Advance notice sent to exim-maintainers@lists.exim.org
  2026-05-27 14:00 UTC  Fix branch and tag exim-4.99.4 pushed to exim-distros
  2026-05-29 14:00 UTC  Public release

-- 
Heiko Schlittermann
On behalf of the Exim Maintainers

[Douglas R. Reno]

I'm going to reassign these to the book for now so whoever wants to do them can do them.

In the meantime I will continue working on rivendell, but I do not want to continue holding the project back on important issues.

[Douglas R. Reno]

Fixed at 7d7e971326b87dbf6f45c5937f0b8348c0a903fe

Reassigning to SecurityAdvisory for an advisory to be filed

[Bruce Dubbs]

Advisory sa-13.0-133 issued.