Exim <4.100.1 SMTP Smuggling via DATA Rejection
CVE-2026-94057 Published on September 19, 2026
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.
Vulnerability Analysis
CVE-2026-94057 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
What is a CRLF Injection Vulnerability?
The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
CVE-2026-94057 has been classified to as a CRLF Injection vulnerability or weakness.
Products Associated with CVE-2026-94057
Want to know whenever a new CVE is published for Exim? stack.watch will email you.
Affected Versions
Exim:- Before 4.100.1 is affected.