A corrective release of the Exim mail server 4.98.1 is available, which addresses the vulnerability (CVE-2025-26794) that allows for SQL code injection into the internal database (Hints DB) used to store message delivery status information.
The vulnerability is present only in the Exim 4.98 release when built with the '_USE_SQLITE_' option, which enables the use of SQLite for the Hints DB (enabled if the output of 'exim -bV' shows 'Hints DB: Using sqlite3'). To exploit the vulnerability, the configuration file must also enable the SMTP ETRN command ('acl_smtp_etrn' must be set to 'accept') and enable ETRN serialization ('smtp_etrn_serialize' must be set to 'true').
Source: opennet.ru
