Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.

tuxcare CENTOS7:CLSA-2026:1791401562: exim: Fix of CVE-2026-94054 (Important)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790254810 advisory.

  - Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds     write. (CVE-2026-94054)

  - Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message,     and instead depends on crafted data sent after a rejection during DATA processing. (CVE-2026-94057)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1790290858 advisory.

  - Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds     write. (CVE-2026-94054)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1790290861 advisory.

  - Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds     write. (CVE-2026-94054)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790759113 advisory.

  - Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds     write. (CVE-2026-94054)

  - Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message,     and instead depends on crafted data sent after a rejection during DATA processing. (CVE-2026-94057)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790759113 advisory.

  - Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds     write. (CVE-2026-94054)

  - Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message,     and instead depends on crafted data sent after a rejection during DATA processing. (CVE-2026-94057)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8834-1 advisory.

    It was discovered that Exim had an out-of-bounds write when Proxy-Protocol was used with an attacker-     controlled proxy. A remote attacker could possibly use this issue to execute arbitrary code.
    (CVE-2026-94054)

    It was discovered that Exim had a use-after-free when certain non-default TLS settings were used with     GnuTLS. A remote attacker could possibly use this issue to cause Exim to crash, resulting in a denial of     service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-94055)

    It was discovered that Exim allowed attackers to read uninitialized data from stack memory when Proxy-     Protocol was used with an attacker-controlled proxy. A remote attacker could possibly use this issue to     obtain sensitive information. (CVE-2026-94056)

    It was discovered that Exim allowed SMTP smuggling via crafted data sent after a rejection during DATA     processing. A remote attacker could possibly use this issue to inject arbitrary email messages.
    (CVE-2026-94057)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6522 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6522-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     September 27, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : exim4     CVE ID         : CVE-2026-94054 CVE-2026-94056 CVE-2026-94057     Debian Bug     : 1148506

    Several vulnerabilities were discovered in the Exim mail transport     agent, which could result in SMTP smuggling, information disclosure,     denial of service or the execution of arbitrary code.

    For the stable distribution (trixie), these problems have been fixed in     version 4.98.2-1+deb13u5.

    We recommend that you upgrade your exim4 packages.

    For the detailed security status of exim4 please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/exim4

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds     write. (CVE-2026-94054)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
361412	AlmaLinux 9.2 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790254810)	Nessus	Alma Linux Local Security Checks	Local	medium
360789	CentOS Linux 8.5 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql (CENTOS8.5:CLSA-2026:1790290858)	Nessus	CentOS Local Security Checks	Local	medium
353148	CentOS Linux 8.4 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql (CENTOS8.4:CLSA-2026:1790290861)	Nessus	CentOS Local Security Checks	Local	medium
352198	Rocky Linux 9.6 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790759113)	Nessus	Rocky Linux Local Security Checks	Local	medium
352196	AlmaLinux 9.6 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790759113)	Nessus	Alma Linux Local Security Checks	Local	medium
350975	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Exim vulnerabilities (USN-8834-1)	Nessus	Ubuntu Local Security Checks	Local	high
350852	Debian dsa-6522 : exim4 - security update	Nessus	Debian Local Security Checks	Local	high
348342	Linux Distros Unpatched Vulnerability : CVE-2026-94054	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-94054

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

high

high

medium