{"id":172666,"date":"2026-05-19T00:24:49","date_gmt":"2026-05-18T22:24:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-exim-4-99-3-ustranena-uyazvimost-pozvolyayushhaya-udalyonnoe-vypolnenie-koda-pri-ispolzovanii-gnutls"},"modified":"2026-05-19T00:24:49","modified_gmt":"2026-05-18T22:24:49","slug":"v-exim-4-99-3-ustranena-uyazvimost-pozvolyayushhaya-udalyonnoe-vypolnenie-koda-pri-ispolzovanii-gnutls","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-exim-4-99-3-ustranena-uyazvimost-pozvolyayushhaya-udalyonnoe-vypolnenie-koda-pri-ispolzovanii-gnutls","title":{"rendered":"In Exim 4.99.3, a vulnerability allowing remote code execution when using GnuTLS has been resolved.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

The developers of the Exim mail server have released a corrective release Exim 4.99.3<\/strong>, addressing a vulnerability in certain configurations of the mail agent. The issue is tracked under the internal identifier EXIM-Security-2026-05-01.1<\/strong>; it is also referenced in the official notice as CVE-TBD<\/strong>.<\/p>\n

The vulnerability belongs to the category of Remote Use-After-Free<\/strong> and manifests during the parsing of message bodies BDAT<\/strong> when using TLS via GnuTLS<\/strong>. BDAT is utilized in the SMTP extension CHUNKING<\/strong> for sending the body of the email in chunks. According to Exim's description, the error may occur when a client sends a TLS close_notify notification during the BDAT transmission before the body transfer is completed, and then adds an additional byte within the same TCP connection.<\/p>\n

In such a sequence, Exim may write data to a memory buffer that has already been freed upon completing the TLS session. This leads to heap corruption and could potentially be exploited for code execution. The notice emphasizes that an attacker only needs to be able to establish a TLS connection and use the SMTP extension CHUNKING \/ BDAT<\/strong>.<\/p>\n

The issue affects Exim 4.97, 4.98, 4.99, 4.99.1, and 4.99.2<\/strong>, but only builds compiled with support for GnuTLS<\/strong>. In the official documentation, this is specified as configurations with USE_GNUTLS=yes; builds using OpenSSL<\/strong> or other TLS libraries are not affected by this vulnerability. The Exim notice also specifically states that configurations declaring STARTTLS<\/strong> and CHUNKING<\/strong>.<\/p>\n

The fix has been included in Exim 4.99.3<\/strong>. According to the developers' description, the patch ensures a clean stack reset of the input processing upon receiving a TLS close_notify during active BDAT transmission, preventing the further use of stale pointers. No other known method to fully resolve the issue, besides updating, is provided in the recommendations.<\/p>\n

The Exim developers received the error report on May 1, 2026<\/strong> from Federico Kirschbaum of XBOW Security<\/strong>. After reviewing the report, the fix was prepared in private repositories, and on May 7, the distributions were notified about the issue via a private mailing list, with limited access to the fixes being granted on May 10, while on May 12, 2026<\/strong> the recommendations and the release containing the fix were published.<\/p>\n

Mail server administrators are advised to check the version of Exim and the TLS backend of the build being used. If server<\/a> works on Exim from 4.97 to 4.99.2 inclusive, built with GnuTLS and supports STARTTLS along with CHUNKING. The Exim project recommends upgrading to Exim 4.99.3<\/strong> or a newer version as soon as possible. Fixed source texts are available in the exim-4.99+fixes branch and the exim-4.99.3 tag, as well as in tarball archives on regular Exim download sites.<\/p>\n

Source: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exim \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0440\u0435\u043b\u0438\u0437 Exim 4.99.3, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0430\u0433\u0435\u043d\u0442\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u043f\u043e\u0434 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u043c EXIM-Security-2026-05-01.1; \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0438 \u0442\u0430\u043a\u0436\u0435 \u0444\u0438\u0433\u0443\u0440\u0438\u0440\u0443\u0435\u0442 \u043a\u0430\u043a CVE-TBD. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u043a\u043b\u0430\u0441\u0441\u0443 Remote Use-After-Free \u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 \u0442\u0435\u043b\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f BDAT \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 TLS \u0447\u0435\u0440\u0435\u0437 GnuTLS. BDAT \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 SMTP-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 CHUNKING \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0442\u0435\u043b\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-172666","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Exim 4.99.3 fixes a vulnerability that allows remote code execution when using GnuTLS | ProHoster","description":"The developers of the Exim mail server have released a corrective update, Exim 4.99.3, which addresses a vulnerability in certain configurations of the mail agent.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/v-exim-4-99-3-ustranena-uyazvimost-pozvolyayushhaya-udalyonnoe-vypolnenie-koda-pri-ispolzovanii-gnutls","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Exim 4.99.3 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 GnuTLS | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exim \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0440\u0435\u043b\u0438\u0437 Exim 4.99.3, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0430\u0433\u0435\u043d\u0442\u0430.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/v-exim-4-99-3-ustranena-uyazvimost-pozvolyayushhaya-udalyonnoe-vypolnenie-koda-pri-ispolzovanii-gnutls","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-18T22:24:49+00:00","article:modified_time":"2026-05-18T22:24:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/172666","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=172666"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/172666\/revisions"}],"predecessor-version":[{"id":173168,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/172666\/revisions\/173168"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=172666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=172666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=172666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}