Exim 4.100.1: four security fixes (Proxy Protocol heap/stack issues, GnuTLS UAF, SMTP smuggling)
Exim maintainers security release 4.100.1 (public announce 18 September 2026 12:00 UTC on exim-announce; oss-security relay 19 Sep by Solar Designer) fixes four issues under GNA GCVE identifiers (no CVE numbers in the primary). (1) EXIM-Security-2026-09-12.1 / GCVE-25-2026-09-50-1 — High — Proxy Protocol v1 out-of-bounds read (~230 bytes) plus single NUL write / heap corruption; affects 4.83–4.100 when Proxy Protocol is built and enabled and a buggy/compromised proxy is in path. (2) EXIM-Security-2026-09-12.2 / GCVE-25-2026-09-55-1 — High — Proxy Protocol v2 uninitialised data → stack-data leak to the wire; same 4.83–4.100 + Proxy Protocol conditions; credit McCaulay Hudson (watchTowr). (3) EXIM-Security-2026-09-12.3 / GCVE-25-2026-09-51-1 — Low — GnuTLS TLS-on-connect use-after-free; 4.98–4.100 with GnuTLS ≥3.6.4 and non-default tls_early_banner_hosts; mitigate by disabling that option. (4) EXIM-Security-2026-09-12.4 / GCVE-25-2026-09-56-1 — Medium — SMTP smuggling after a data-phase rejection; all versions ≤4.100; credit Hudson/watchTowr. No CVSS base scores published in the advisory. Fix: upgrade to 4.100.1 from ftp.exim.org / code.exim.org tag exim-4.100.1 (signed). Wire amplify: CyberSecurityNews 21 Sep. Primary: Exim announce + oss-security.
- Product
- Exim MTA (Proxy Protocol; GnuTLS TLS-on-connect; SMTP reception)
- Versions
- Fixed: 4.100.1. Affected ranges: Proxy Protocol issues 4.83–4.100; GnuTLS UAF 4.98–4.100 (tls_early_banner_hosts); SMTP smuggling all ≤4.100
- Exploited in Australia?
- unknown
- Patch to
- Upgrade Exim to 4.100.1 from official ftp.exim.org / signed tag exim-4.100.1. Interim for GnuTLS UAF only: disable tls_early_banner_hosts. Proxy Protocol issues have no workaround other than upgrade / removing compromised proxies.
Primary: Exim-announce — Security Release 4.100.1 (18 Sep 2026) · Vendor: Exim FTP — exim-4.100.1 signed tarballs · oss-security — Exim Security Release 4.100.1 (Solar Designer, 19 Sep 2026)