CVE-2026-94057: Exim SMTP Smuggling Vulnerability

CVE-2026-94057 Overview

CVE-2026-94057 is an SMTP smuggling vulnerability in Exim mail transfer agent versions before 4.100.1. The flaw allows a remote attacker to cause the server to accept a received message that does not correspond to any sent message. Instead, the accepted content depends on crafted data transmitted after a rejection during DATA processing. The issue is tracked under CWE-93: Improper Neutralization of CRLF Sequences and stems from inconsistent line-terminator handling in the SMTP state machine.

Critical Impact
Attackers can inject unauthorized email messages that appear to originate from trusted senders, enabling phishing, spoofing, and bypass of email authentication controls such as SPF, DKIM, and DMARC.

Affected Products

Exim versions prior to 4.100.1
Mail servers running vulnerable Exim builds exposed to inbound SMTP
Downstream mail relays and gateways processing traffic from affected Exim hosts

Discovery Timeline

2026-09-19 - CVE-2026-94057 published to the National Vulnerability Database
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-94057

Vulnerability Analysis

SMTP smuggling exploits differences in how mail servers interpret end-of-data sequences during the DATA phase of the SMTP protocol. In CVE-2026-94057, Exim mishandles the transition after issuing a rejection during DATA processing. An attacker can supply crafted content following the rejection that the server treats as a legitimate message, even though no matching message was sent according to the protocol specification.

The consequence is that Exim delivers a message whose contents were never part of a completed SMTP transaction. This breaks the trust boundary between the sending client and the receiving server. Because the smuggled message enters the mail flow through a trusted Exim instance, it can inherit authentication assumptions applied to the connection.

The issue is fixed in Exim 4.100.1, which corrects the parsing behavior after a DATA rejection.

Root Cause

The root cause is improper neutralization of CRLF sequences [CWE-93] in the SMTP DATA handler. When Exim rejects a message mid-transfer, it does not correctly resynchronize the input stream. Subsequent bytes are treated as a new message payload rather than a continuation of the rejected transaction.

Attack Vector

Exploitation requires only network access to the SMTP listener. No authentication or user interaction is needed. An attacker connects to the vulnerable Exim server, triggers a rejection during the DATA command, and then sends crafted CRLF-delimited content that Exim accepts and processes as an independent message. Full technical detail is available in the Exim mailing list message.

Detection Methods for CVE-2026-94057

Indicators of Compromise

Received messages in mail logs with no corresponding MAIL FROM or RCPT TO transaction identifiers
SMTP sessions containing a DATA rejection immediately followed by additional data bytes before QUIT
Delivered messages whose Received: headers reference a session that logged a prior rejection
Unexpected DMARC or SPF pass results for messages that appear inconsistent with sender history

Detection Strategies

Correlate SMTP transaction logs to identify messages accepted without a complete protocol handshake
Parse Exim's mainlog for sequences where a rejection log line is followed by an accepted message on the same connection
Deploy protocol-aware network monitoring to flag SMTP sessions with anomalous byte streams after a 5xxDATA response

Monitoring Recommendations

Enable verbose Exim logging with log_selector = +smtp_protocol_error +smtp_syntax_error +all_parents
Forward mail server logs to a centralized platform for correlation across relays
Alert on repeated DATA rejections from the same source IP within short time windows

How to Mitigate CVE-2026-94057

Immediate Actions Required

Upgrade all Exim installations to version 4.100.1 or later
Inventory mail infrastructure to identify every host running an affected Exim build
Review recent mail logs for evidence of smuggled messages predating the patch
Verify that upstream and downstream mail relays enforce strict CRLF handling

Patch Information

The Exim project addressed the vulnerability in release 4.100.1. Administrators should apply the upstream patch or install vendor-provided packages that include the fix. Refer to the Exim mailing list message for the maintainer announcement.

Workarounds

Restrict inbound SMTP access to trusted networks where feasible until patching is complete
Front vulnerable Exim instances with a strict SMTP proxy that enforces RFC-compliant line termination
Increase logging verbosity to capture protocol anomalies while remediation is in progress

bash

# Verify installed Exim version
exim -bV | head -n 1

# Debian/Ubuntu upgrade path
sudo apt update && sudo apt install --only-upgrade exim4

# RHEL/Rocky upgrade path
sudo dnf upgrade exim

# Enable protocol error logging in /etc/exim/exim.conf
# log_selector = +smtp_protocol_error +smtp_syntax_error +all_parents

# Restart the service after patching
sudo systemctl restart exim4