Loading vulnerability…
Exim musl libc PTR Record Denial of Service
CVE-2026-40684 is a denial-of-service vulnerability in Exim before version 4.99.2 that affects deployments running on systems using musl libc rather than glibc. When Exim processes malformed DNS data in PTR records, an oddity related to octal printing in the musl libc environment can cause the connection instance to crash. The issue is triggered during handling of attacker-controlled or otherwise malicious PTR response data and results in abnormal termination of the affected Exim connection context.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a remote, unauthenticated attacker to crash an Exim connection instance by causing the server to process malformed PTR record data on affected musl libc-based systems. The practical impact is denial of service against mail-handling operations associated with the targeted connection. Available information does not indicate code execution or privilege escalation for this CVE.
If you can’t patch tonight, do this now.
Where immediate upgrade is not possible, reduce exposure by limiting reliance on vulnerable Exim deployments running on musl libc, restricting unnecessary external interaction paths that can trigger reverse-DNS or PTR processing, and placing the service behind operational controls that reduce attacker reachability and repeated crash attempts. Because the flaw is fixed in Exim itself and is platform-specific to musl libc environments, upgrading remains the primary mitigation.
Patch, then assume compromise.
Upgrade Exim to version 4.99.2 or later. The security release 4.99.2 includes the vendor fix for CVE-2026-40684 along with other Exim security corrections. Older Exim branches are not actively maintained, so affected legacy deployments should be moved to a supported fixed release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.