version 4.100.1 was released with four security fixes, including one in the Proxy Protocol, that affect email servers. The issues affect versions 4.83 through 4.100, three of which have no workaround available.
The fixes cover issues in the protocol itself, the GnuTLS , and SMTP message processing. The Exim Project recommends that administrators install 4.100.1 immediately, rather than relying on temporary configuration changes.
See also: New Exim BDAT vulnerability exposes GnuTLS constructs
What Exim 4.100.1 fixes in Proxy Protocol
According to the release note, two of the issues are in Proxy Protocol support. The first can, under certain circumstances with v1 and an untrusted or compromised proxy, allow data to be read from beyond a heap area and a single byte written to memory.
The second concerns Proxy Protocol v2 and allows uninitialized data to be leaked from the stack. The impact depends on Exim configuration and the presence of a proxy in front of the server, but exposing memory contents could help a remote attacker map the environment.
The third fix addresses a memory usage error after freeing memory in GnuTLS. It affects installations with the optional tls_early_banner_hosts and can lead primarily to a crash of a download process, i.e. a denial of service.
Exim 4.100.1 Proxy Protocol and SMTP smuggling vulnerability
The fourth fix addresses SMTP smuggling, a scenario in which the server can end up processing a message other than the one it believes was sent. The attack requires specially crafted data after being discarded during the DATA.
The CVE-2026-94057 rates the issue as medium severity and attributes the remote exploitation to high complexity conditions. The entry notes that the message inserted in this way follows normal incoming mail processing, but does not negate the need to install the patch.
The remaining related entries describe the memory leak as CVE-2026-94056, the GnuTLS bug as CVE-2026-94055 , and the v1 issue as CVE-2026-94054. CVE numbers appear in vulnerability lists, while the Exim Project accompanies the release with its own security identifiers.
See also: cPanel: Critical SQL vulnerability allows execution as root
What should administrators do?
Exim 4.100.1 is the recommended solution for all installations from 4.83 through 4.100. For the GnuTLS bug, there is a temporary workaround to disable tls_early_banner_hosts, but the change does not cover the remaining three vulnerabilities and does not replace the upgrade.
Before installation, infrastructure teams should check the package version, engine settings, and proxy topology. After the upgrade, SMTP services, logs, and rules applied in the DATAto confirm that mail continues to be routed properly.
The SecNews technical team recommends prioritizing Exim that are directly exposed to the internet or use this mechanism. The release of the version is not accompanied by a known active exploit incident, but the lack of workarounds for most issues makes timely installation of the fix the safest option.
Post-change checks should include failed connections, unusual SMTP responses, and requests that terminate in the DATA. In multi-node environments, the update needs to be applied evenly, because an old server can remain a weak link in the same mail flow. Recording versions and settings also makes it easier to verify that the maintenance window was completed without gaps.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
In production systems, it is useful to have a backup of the configuration and record the current topology beforehand. This allows the team to compare the behavior before and after the change and to restore a service that is experiencing a problem in a controlled manner. The process should be completed on all nodes, not just the central mail server, so that there is no difference in protection between incoming and outgoing mail paths.
See also: Mozilla Firefox: Fixes Heap Buffer Overflow vulnerability
Administrators can download the release from the official Exim channels and schedule the change within the next available maintenance window. Maintaining an older release without additional protection leaves the vulnerabilities fixed by Exim 4.100.1.
