CVE-2026-94057Medium· 4.0▾ SunlitExim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 22 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.3%
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.
exim < 4.100.1Upgrade past the affected range:
exim 4.100.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94054High· 7.0Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
CVE-2026-94056High· 7.5Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.
CVE-2026-94055Low· 3.7Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.
CVE-2025-67896High· 7.0Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation.
CVE-2026-118371Low· 3.7LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line
CVE-2026-118372Low· 3.7LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path