Exim 4.100.1 patches four flaws including two High-severity Proxy Protocol bugs

What shipped

The Exim project released version 4.100.1 on 18 September 2026, closing four security defects in the widely deployed open-source mail transfer agent. According to a remediation guide published on dev.to, which draws on the official Exim release announcement and coverage from securityonline.info, the set comprises two High-severity Proxy Protocol vulnerabilities, a Medium-severity SMTP smuggling flaw and a Low-severity GnuTLS use-after-free. The highest CVSS score in the batch is 7.5. The maintainers report no evidence of active exploitation and no public proof-of-concept code.

The High-severity Proxy Protocol flaws

Both of the serious bugs sit in Exim's handling of the Proxy Protocol, the mechanism a front-end load balancer uses to pass a client's original address to the backend server.

In the version 1 parser, a remote attacker can read roughly 230 bytes beyond the end of a heap allocation and perform a single NUL-byte write. The version 2 parser leaks uninitialized stack memory back to the attacker. Both share the same precondition: an upstream proxy that is itself flawed or already compromised, terminating connections before they reach Exim. That condition narrows the practical attack surface, but it also means the bugs become reachable precisely when something else on the perimeter has already gone wrong.

The GnuTLS crash and SMTP smuggling

The remaining two issues are lower rated but still deserve attention. A use-after-free in the GnuTLS code path can crash the process that accepts incoming mail, interrupting message delivery. It only triggers under the non-default TLS-on-connect configuration, so standard setups are not exposed.

The SMTP smuggling issue is subtler. By sending crafted data after a rejection during the DATA phase, an attacker can have a message delivered whose content diverges from what the sending side recorded in its logs. The integrity guarantee that a received message matches the one that was sent is weakened, which matters for audit trails and filtering pipelines alike.

Who is affected

Per the dev.to guide, the Proxy Protocol bugs and the SMTP smuggling flaw affect every Exim release from 4.83 through 4.100, while the GnuTLS use-after-free affects 4.98 through 4.100. Version 4.100.1 is the fixed release for all four.

For a sense of scale, a ZoomEye search for the Exim fingerprint returned just over 10.1 million assets. The guide cautions that this figure reflects fingerprint matches rather than confirmed vulnerable installations, and a CVE-scoped query for CVE-2026-94055 returned no indexed results.

What operators should do

The guidance is straightforward: upgrade to 4.100.1 from the official Exim download mirror. Three of the four defects ship without a workaround, so patching is the only real remedy for them. The lone exception is the GnuTLS use-after-free, where disabling the non-default tls_early_banner_hosts option works as a stopgap.

After upgrading, operators should confirm the running version and re-examine any proxy layer that terminates connections ahead of Exim, since both High-severity bugs assume a faulty or compromised intermediary. A review of message-integrity controls is also recommended, because the smuggling flaw touches every release up to and including 4.100.

Why it matters

Exim routes mail for a large share of the internet's SMTP infrastructure, and this release bundles memory-disclosure bugs that activate exactly when a trusted perimeter component misbehaves. With no workarounds available for three of the four flaws, and with exploitation that could go unnoticed since the Proxy Protocol bugs expose heap and stack data to a remote peer, the upgrade is cheap insurance. The SMTP smuggling flaw also carries an operational cost beyond security: any system that depends on delivery logs matching delivered messages should treat this patch as a correctness fix, not merely a hardening step.