Exim 4.100.1 is a security release that fixes four newly disclosed vulnerabilities, but the practical exposure is not the same for every Exim server. Two High-severity issues affect Proxy Protocol processing, one Low-severity issue affects a narrow non-default GnuTLS TLS-on-connect configuration, and one Medium-severity SMTP-smuggling issue has the broadest upstream version range.
The safest administrator decision is therefore not simply to ask whether Exim is installed. Check the server version, Proxy Protocol use, TLS implementation and relevant runtime settings, then verify whether the operating-system vendor has shipped the upstream 4.100.1 fixes or an equivalent backport.
Exim 4.100.1 fixes four different security issues
The four issues are CVE-2026-94054, CVE-2026-94055, CVE-2026-94056 and CVE-2026-94057. Their consequences range from an out-of-bounds heap read and single-byte write to a use-after-free, stack-data disclosure and SMTP message-smuggling condition.
That list should not be read as four universally reachable vulnerabilities. Three of the four have important configuration or topology prerequisites that materially narrow which deployments are exposed.
CVE-2026-94054: Proxy Protocol v1 memory-safety flaw
CVE-2026-94054 affects Exim versions 4.83 through 4.100 in deployments using Proxy Protocol. Exim’s advisory says exploitation depends on receiving malformed Proxy Protocol input through a configured proxy that is buggy or compromised.
The flaw can produce an out-of-bounds heap read and a single NUL-byte heap write. Exim rates this issue High severity, but TPS found no reviewed evidence supporting a claim that any arbitrary Internet SMTP client can directly trigger the bug without the required Proxy Protocol deployment path.
CVE-2026-94056: Proxy Protocol v2 stack disclosure
CVE-2026-94056 has a similar deployment boundary. It affects Exim 4.83 through 4.100 when Proxy Protocol is in use and malformed input arrives through the relevant configured proxy path.
The flaw can cause uninitialized stack data to be transmitted. Exim also rates this issue High severity. Administrators should therefore treat Proxy Protocol usage as a key exposure check for both CVE-2026-94054 and CVE-2026-94056.
CVE-2026-94055: GnuTLS use-after-free needs a narrow configuration
CVE-2026-94055 affects Exim 4.98 through 4.100 only under a specific combination of conditions: the Exim build uses GnuTLS 3.6.4 or later, TLS-on-connect is enabled, and the non-default tls_early_banner_hosts option is configured.
The issue is a use-after-free and Exim rates it Low severity. The maintainers state that disabling tls_early_banner_hosts mitigates this vulnerability when an immediate upgrade cannot be performed. That mitigation applies to this GnuTLS issue only; it does not resolve the other three vulnerabilities.
CVE-2026-94057: SMTP smuggling has the broadest version range
CVE-2026-94057 is the SMTP-smuggling issue and affects all upstream Exim versions through 4.100. The condition involves a message being rejected during the SMTP DATA phase while crafted trailing input can be interpreted differently from what the sending system recorded.
Exim states that a smuggled message remains subject to the receiving server’s normal configured message-processing controls. The issue should therefore not be described as a universal bypass of all Exim filtering or policy enforcement.
Which Exim versions are affected?
| Vulnerability | Affected upstream versions | Important prerequisite | Upstream fix |
|---|---|---|---|
| CVE-2026-94054 | 4.83 through 4.100 | Proxy Protocol deployment and malformed input through a buggy or compromised configured proxy | 4.100.1 |
| CVE-2026-94055 | 4.98 through 4.100 | GnuTLS 3.6.4+, TLS-on-connect and non-default tls_early_banner_hosts | 4.100.1 |
| CVE-2026-94056 | 4.83 through 4.100 | Proxy Protocol deployment and malformed input through a buggy or compromised configured proxy | 4.100.1 |
| CVE-2026-94057 | All versions through 4.100 | SMTP DATA-phase rejection plus crafted trailing data | 4.100.1 |
The upstream version ranges are useful for understanding the vulnerability boundaries, but distribution package numbers can differ because Linux distributions frequently backport security fixes. Administrators should not assume that a package is vulnerable or fixed solely because its displayed version differs from upstream 4.100.1.
Debian still showed vulnerable packages during the TPS review
The Debian Security Tracker state reviewed by TPS marked Exim packages in Bookworm, Trixie, Forky and Sid as vulnerable to the four CVEs. That is a point-in-time package state and may change as Debian publishes security updates.
TPS did not establish a sufficiently reliable current package matrix for Ubuntu, Red Hat or SUSE during this research pass. Administrators on those distributions should use the current vendor CVE tracker or security advisory rather than infer their status from Debian or the upstream Exim version.
Public disclosure does not establish active exploitation
The vulnerabilities and fixes are public, but TPS did not establish authoritative evidence that CVE-2026-94054, CVE-2026-94055, CVE-2026-94056 or CVE-2026-94057 are being actively exploited in the wild. TPS also did not establish a complete authoritative public-proof-of-concept state across all four vulnerabilities.
The distinction matters: a public security advisory requires remediation attention, but it should not automatically be described as an actively exploited campaign or an emergency remote-code-execution event.
What Exim administrators should check now
Record the operating-system distribution, package version and Exim build rather than relying only on an upstream version comparison.
If Proxy Protocol is not used, the two High-severity Proxy Protocol flaws do not share the same practical exposure path described in Exim’s advisory.
Determine whether the Exim build uses GnuTLS and whether TLS-on-connect is enabled.
The CVE-2026-94055 path additionally depends on this non-default option. Exim states that disabling it mitigates that one flaw before upgrade.
CVE-2026-94057 has the broadest upstream version exposure and is not limited to Proxy Protocol or the GnuTLS configuration above.
Use the current operating-system vendor’s CVE tracker or security advisory to determine whether your package already contains an equivalent backport.
Exim’s upstream corrected release is 4.100.1. On packaged systems, install the vendor-supported release containing the corresponding fixes.
What remains unresolved
The completed TPS review did not establish the full current Ubuntu, Red Hat/RHEL or SUSE/openSUSE package state, and it did not establish active exploitation. Those points should remain separate from the confirmed facts that Exim 4.100.1 fixes four disclosed vulnerabilities and that the exposure prerequisites differ significantly between them.
This same article should be updated if major distributions publish new fixed packages, Exim revises the advisories, credible exploit research changes the exposure model, active exploitation is confirmed or a vulnerability is added to CISA’s Known Exploited Vulnerabilities catalog.