Exim 4.99.2 Patches Four Mail Server Vulnerabilities

Exim has released version 4.99.2 as a security update to fix four vulnerabilities in the mail transfer agent, tracked as CVE-2026-40684, CVE-2026-40685, CVE-2026-40686, and CVE-2026-40687. The flaws affect specific configurations and stem from unsafe handling of DNS PTR data, corrupt JSON in headers, malformed UTF-8 in headers, and the SPA authenticator when interacting with a hostile or compromised external SPA/NTLM service. Reported impacts include crashes, heap corruption, out-of-bounds reads and writes, and possible heap data leakage, with older Exim branches potentially affected but no longer actively maintained.

One of the disclosed issues, CVE-2026-40684, can crash an Exim connection on systems using musl libc when malformed DNS PTR record data is processed; the same behavior was not reported on glibc systems. Exim said the bug is linked to an octal-printing oddity in musl libc and noted that the issue was raised with the musl maintainer. The fixes were published through Exim's security advisory process and made available in source tarballs and the project's Git repository under the exim-4.99.2 tag.