Exim 4.100.1 Remediation Guide: Patching, Workarounds and Verification
Exim 4.100.1 Remediation Guide: Patching, Workarounds and Verification Vulnerability overview On 18 September 2026 the Exim project published version 4.100.1, fixing four security defects: two High-severity Proxy Protocol bugs, a Low-severity GnuTLS use-after-free and a Medium-severity SMTP smuggling issue. The maintainers report no confirmed exploitation and no public proof-of-concept. The top CVSS score in the set is 7.5. Mechanism and exploitation conditions Proxy Protocol version 1 (High) A remote attacker can read roughly 230 bytes past a heap allocation and perform a single NUL-byte write. A buggy or compromised proxy in front of Exim is required. Proxy Protocol version 2 (High) The version 2 parser leaks uninitialized stack data to the attacker, under the same proxy precondition. GnuTLS use-after-free (Low) This defect crashes a receive process, but only under the non-default TLS-on-connect setting with GnuTLS. SMTP smuggling (Medium) Crafted data placed after a rejection during the DATA phase lets an attacker deliver a message that differs from the one the sender logged. Impact The Proxy Protocol bugs expose adjacent heap or stack memory to a remote peer. The GnuTLS flaw interrupts mail acceptance by crashing the receive process. The smuggling flaw weakens the integrity guarantee that a delivered message matches the message sent. Affected products and scope The Proxy Protocol bugs and the SMTP smuggling issue affect Exim 4.83 through 4.100. The GnuTLS use-after-free affects Exim 4.98 through 4.100. Exim 4.100.1 is the fixed release. Exposure context ZoomEye returned 10,101,302 assets for app=“Exim”. The figure describes fingerprint matches, not confirmed vulnerable installations. A CVE-scoped query for vul.cve=“CVE-2026-94055” returned no indexed results. Remediation and mitigations Upgrade to Exim 4.100.1. Three of the four defects ship without a workaround, so patching is the direct path. For the GnuTLS defect alone, disable the non-default tls_early_banner_hosts option as a stopgap. Download the fixed release from the official Exim download mirror. Confirm the running version after upgrade and re-check any proxy layer that terminates connections before Exim, since both High-severity bugs assume a faulty or compromised proxy. Review message-integrity controls, because the smuggling flaw affects every version up to 4.100. References Exim 4.100.1 security release announcement (official Exim project). Exim 4.100.1 patches four security vulnerabilities, securityonline.info, 21 September 2026: https://securityonline.info/exim-4-100-1-vulnerabilities/