Hi,

The following vulnerabilities were published for exim4.

Andreas, I'm putting this at RC level, but I'm not sure how common
exploitable setups are for the more severe ones.

CVE-2026-94054[0]:
| Exim before 4.100.1, when Proxy-Protocol is used with an attacker-
| controlled proxy, has an out-of-bounds write.


CVE-2026-94055[1]:
| Exim before 4.100.1, when certain non-default TLS settings are used
| with GnuTLS, has a use-after-free.


CVE-2026-94056[2]:
| Exim before 4.100.1, when Proxy-Protocol is used with an attacker-
| controlled proxy, allows attackers to read certain uninitialized
| data from stack memory.


CVE-2026-94057[3]:
| Exim before 4.100.1 allows SMTP smuggling in which the received
| message does not match any sent message, and instead depends on
| crafted data sent after a rejection during DATA processing.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-94054
https://www.cve.org/CVERecord?id=CVE-2026-94054
[1] https://security-tracker.debian.org/tracker/CVE-2026-94055
https://www.cve.org/CVERecord?id=CVE-2026-94055
[2] https://security-tracker.debian.org/tracker/CVE-2026-94056
https://www.cve.org/CVERecord?id=CVE-2026-94056
[3] https://security-tracker.debian.org/tracker/CVE-2026-94057
https://www.cve.org/CVERecord?id=CVE-2026-94057
[4] https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
exim4, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148506@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andreas Metzler <ametzler@debian.org> (supplier of updated exim4 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 22 Sep 2026 11:25:05 +0200
Source: exim4
Architecture: source
Version: 4.100.1-1
Distribution: unstable
Urgency: high
Maintainer: Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>
Changed-By: Andreas Metzler <ametzler@debian.org>
Closes: 1148506
Changes:
 exim4 (4.100.1-1) unstable; urgency=high
 .
   * Upload to unstable.
   * New upstream version. Closes: #1148506
     CVE-2026-94054 EXIM-Security-2026-09-12.1 (GCVE-25-2026-09-50-1)
      Exim before 4.100.1, when Proxy-Protocol is used with an attacker-
      controlled proxy, has an out-of-bounds write.
     CVE-2026-94055 EXIM-Security-2026-09-12.3 (GCVE-25-2026-09-51-1)
      Exim before 4.100.1, when certain non-default TLS settings are used
      with GnuTLS, has a use-after-free.
     CVE-2026-94056 EXIM-Security-2026-09-12.2 (GCVE-25-2026-09-55-1)
      Exim before 4.100.1, when Proxy-Protocol is used with an attacker-
      controlled proxy, allows attackers to read certain uninitialized
      data from stack memory.
     CVE-2026-94057 EXIM-Security-2026-09-12.4 (GCVE-25-2026-09-56-1)
      Exim before 4.100.1 allows SMTP smuggling in which the received
      message does not match any sent message, and instead depends on
      crafted data sent after a rejection during DATA processing.
Checksums-Sha1:
 8f20ed97274414f6d7caecf753175317e2b6eff2 3455 exim4_4.100.1-1.dsc
 dd1c70a3f8d7494324e5a7b5625c740adb005853 2007956 exim4_4.100.1.orig.tar.xz
 a2a1e173ad6e447884e2881de1d3f665937d8b16 252 exim4_4.100.1.orig.tar.xz.asc
 ce2959b55857b2e5a9562dfa4ce22281c472591a 463248 exim4_4.100.1-1.debian.tar.xz
Checksums-Sha256:
 56dd0420a8d0103350f768ca7ada0809b05ba826e7ff59be304b46d98123d636 3455 exim4_4.100.1-1.dsc
 e9fb41f6724a5b136d64c9d19dbc5f26494af879a3e7e3190f91639eaa79fa0d 2007956 exim4_4.100.1.orig.tar.xz
 a94a658998ff794a93db399b9310a60e2382389d9c105de7899293967c93f787 252 exim4_4.100.1.orig.tar.xz.asc
 eae0695f7ccb0557bc9bdc1465e51bb8631ee9af325acdc64a586dc8992f06f0 463248 exim4_4.100.1-1.debian.tar.xz
Files:
 dfe83c6026f57652ba4090ea498f423a 3455 mail standard exim4_4.100.1-1.dsc
 2156671c9739e4e53b7b2fd9357038ab 2007956 mail standard exim4_4.100.1.orig.tar.xz
 c31716f2a37496b674ed60938ba3a6c2 252 mail standard exim4_4.100.1.orig.tar.xz.asc
 65709e8fe50098e470451079dd484035 463248 mail standard exim4_4.100.1-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAmqyS3EACgkQpU8BhUOC
FIRLpQ//Wxx5w8hQcUSaZzqug1/PQmOTDn/jCt8+s3AaGpX26ClIHS0aspdo8rB9
multTflfz1mgsvVl2blAgkCaApGYfzl2Hs3omrNnSQG6rNA0EeQSjwPQKapbyhUJ
Fj8KZ0XOmh7PBr4tor7Bao+C0VJ+bWkDNglBVFWeB5QI6cEoeG6YAxKnNJtAQVQ0
OpFqqK117G22DNNiWZxzpp8TfkBZVRbs/DGs73tacmDIdUtp498xauTgg7V7OwIr
B6T1f0Ir0Raw04TRdtlWWg7B4ZXKv08sxznXWlAZfXXoBXaQCsNIQGtV+Sp/1AYm
ETuAyx9Vq6xFtCxXlQc+JN4G70r5MLKocigvLsnV5K/pgzMKrFTZO1ndHRGKP8BP
paQd9DbROk0daw0vgNKHg2ngdFV7vIJzD4A1YlCeuHbbk4g8Qb14B65Z3OD0gEvR
b8dyBhuRcFEirImAN/JPG+ClpLePLx+nc2iyRoMFkaczvPIsN/j0cKVXFCjSgyw/
MGBjAN/f7UtAEKWBTNuz83A6kiDAemNzQGnSVJyiznqK4Pjdiy6Zx+Elqx3yfl9J
dl2nC4gWZZwqJ4xOTzUadpgCymPsDdt9UG2vMfftS+ht0DsJDVNG44armVQSxNKx
mHBwfp2Mdi/HBlJnJRG91mzcodpXoqYht40WXAb1N3da2QT9pxE=
=fExs
-----END PGP SIGNATURE-----