Denial of Service Vulnerability in Exim Mail Transfer Agent

CVE-2026-40684

What is CVE-2026-40684?

A vulnerability exists in the Exim Mail Transfer Agent affecting versions before 4.99.2. On systems utilizing musl libc, an attacker could exploit malformed DNS data embedded in PTR records, potentially causing the Exim connection instance to crash. This issue arises from an anomaly in the dn_expand function's handling of octal representations, leading to service disruptions for users relying on the affected versions.

References