Executive brief
Exim mail server (versions before 4.100.1) is vulnerable to SMTP smuggling attacks where a remote attacker can cause the mail server to receive and process a message that differs from what the sending system sent and logged. An attacker exploits this by sending crafted data after a message rejection during the DATA phase, potentially allowing unauthorized message injection or modification.
Technical details
This SMTP smuggling vulnerability in Exim's SMTP reception layer allows an attacker to send crafted data after a DATA-phase rejection, causing a mismatch between the logged message and what is actually received and processed. The vulnerability affects all Exim versions up to 4.100 and requires no special configuration or authentication. The fix, released in version 4.100.1, corrects the handling of message data after rejection points.
Affected products
- Exim Exim before 4.100.1
Timeline
- 2026-09-18: disclosed: Public release of Exim 4.100.1 with security fixes
- 2026-09-18: patched: Fix available in Exim 4.100.1