critical
CVE-2026-40685
In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds h ...
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Ubuntu (medium).
Description
In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \ skipping.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.23 | exim | 4.98.2-r0 |
| alpine 3.24 | exim | 4.98.2-r0 |
| alpine edge | exim | 4.98.2-r0 |
| chainguard | exim | 4.99.5-r0 |
| debian 11 | exim4 | no fix listed |
| debian 12 | exim4 | 4.96-15+deb12u9 |
| debian 13 | exim4 | 4.98.2-1+deb13u2 |
| debian 14 | exim4 | 4.99.2-1 |
| echo | exim4 | 4.96-15+deb12u9 |
| rapidfort debian 12 | exim4 | 0:4.98.2-1+deb13u2, 0:4.99.2-1 |
| rapidfort debian 13 | exim4 | 0:4.98.2-1+deb13u2, 0:4.99.2-1 |
| rapidfort fedora 43 | exim, exim-clamav, exim-greylist and 3 more | 4.99.2-1.fc43 |
Show all 38 entries from 23 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.23 | exim | 4.98.2-r0 |
| alpine 3.24 | exim | 4.98.2-r0 |
| alpine edge | exim | 4.98.2-r0 |
| chainguard | exim | 4.99.5-r0 |
| debian 11 | exim4 | no fix listed |
| debian 12 | exim4 | 4.96-15+deb12u9 |
| debian 13 | exim4 | 4.98.2-1+deb13u2 |
| debian 14 | exim4 | 4.99.2-1 |
| echo | exim4 | 4.96-15+deb12u9 |
| rapidfort debian 12 | exim4 | 0:4.98.2-1+deb13u2, 0:4.99.2-1 |
| rapidfort debian 13 | exim4 | 0:4.98.2-1+deb13u2, 0:4.99.2-1 |
| rapidfort fedora 43 | exim | 4.99.2-1.fc43 |
| rapidfort fedora 43 | exim-clamav | 4.99.2-1.fc43 |
| rapidfort fedora 43 | exim-greylist | 4.99.2-1.fc43 |
| rapidfort fedora 43 | exim-mon | 4.99.2-1.fc43 |
| rapidfort fedora 43 | exim-mysql | 4.99.2-1.fc43 |
| rapidfort fedora 43 | exim-pgsql | 4.99.2-1.fc43 |
| rapidfort Oracle Linux 10 | exim | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 10 | exim-clamav | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 10 | exim-greylist | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 10 | exim-mon | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 10 | exim-mysql | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 10 | exim-pgsql | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 9 | exim | 4.99.2-1.el9 |
| rapidfort Oracle Linux 9 | exim-clamav | 4.99.2-1.el9 |
| rapidfort Oracle Linux 9 | exim-greylist | 4.99.2-1.el9 |
| rapidfort Oracle Linux 9 | exim-mon | 4.99.2-1.el9 |
| rapidfort Oracle Linux 9 | exim-mysql | 4.99.2-1.el9 |
| rapidfort Oracle Linux 9 | exim-pgsql | 4.99.2-1.el9 |
| rapidfort ubuntu 20.04 | exim4 | 0:4.95-4ubuntu2.7, 0:4.97-4ubuntu4.4, 0:4.99.1-1ubuntu1.1 |
| rapidfort ubuntu 22.04 | exim4 | 0:4.95-4ubuntu2.7, 0:4.97-4ubuntu4.4, 0:4.99.1-1ubuntu1.1 |
| rapidfort ubuntu 24.04 | exim4 | 0:4.95-4ubuntu2.7, 0:4.97-4ubuntu4.4, 0:4.99.1-1ubuntu1.1 |
| ubuntu 20.04-ESM | exim4 | 4.93-13ubuntu1.12+esm1 |
| ubuntu 22.04 | exim4 | 4.95-4ubuntu2.7 |
| ubuntu 24.04 | exim4 | 4.97-4ubuntu4.4 |
| ubuntu 25.10 | exim4 | 4.98.2-1ubuntu2.1 |
| ubuntu 26.04 | exim4 | 4.99.1-1ubuntu1.1 |
| wolfi | exim | 4.99.5-r0 |
References
- https://code.exim.org/exim/exim/commit/9fdc057e71b87c87a0d3d2288b2810a0efaaba57
- https://exim.org/static/doc/security/CVE-2026-40685.txt
- https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40685.assessment
- https://lists.exim.org/lurker/message/20260429.121733.f58d9686.en.html
- https://ubuntu.com/security/notices/USN-8228-1
- https://ubuntu.com/security/notices/USN-8382-1
- https://www.cve.org/CVERecord?id=CVE-2026-40685
- https://www.openwall.com/lists/oss-security/2026/04/30/21