Exim on Debian: DSA-6265-1 fixes critical BDAT use-after-free (CVE-2026-45185), plus DSA-6309-1

In May 2026 Debian released two Exim updates for Debian 12 (bookworm) and Debian 13 (trixie). DSA-6265-1 (12 May) fixed five vulnerabilities which, in Debian's words, may result in remote code execution, denial of service or an information leak. The headline issue, CVE-2026-45185, is rated Critical (CVSS 9.8) by the Exim maintainers. DSA-6309-1 (29 May) followed with a fix for an information leak in PROXY-protocol handling.

If your mail server runs Exim and has not been updated since early May, treat this as urgent.

At a glance

What the vulnerabilities are

CVE-2026-45185: remote use-after-free during BDAT (Critical)

According to the Exim advisory, the bug is in Exim's GnuTLS code. If a client sends a TLS close_notify alert in the middle of a BDAT (CHUNKING) message body and then one more byte in cleartext on the same connection, Exim can write into memory already freed during TLS teardown, corrupting the heap. The attacker only needs to open a TLS connection and use CHUNKING, so no login is required. Exim lists versions 4.97 to 4.99.2 as affected, and only builds that use GnuTLS. Debian's Exim daemons are linked against GnuTLS, and Debian shipped the fix for bookworm's older 4.96 package as well. Exim says there is no mitigation other than upgrading.

Four configuration-dependent issues

Exim's assessments describe when each applies:

• CVE-2026-40685 (CVSS 6.5): the configuration uses JSON operators on input from outside; can cause remote heap corruption.
• CVE-2026-40687 (4.8): the spa authenticator is configured; can crash the connection process and leak data.
• CVE-2026-40686 (3.7): UTF-8 operators are used on outside input; heap data can leak.
• CVE-2026-40684 (5.9): only builds using musl libc instead of glibc; a crafted PTR record can crash a connection. Debian's packages use glibc.

CVE-2026-48840: PROXY protocol leak (DSA-6309-1)

Exim rates this Moderate (CVSS 5.3). When hosts_proxy is set, a short PROXY v2 header can make Exim copy uninitialised stack memory into the sender address and show it in the SMTP banner. Exim notes the leaked bytes can help an attacker defeat ASLR as part of a larger attack. Only servers with a non-empty hosts_proxy, typically behind a load balancer, are exposed.

None of these CVEs is in the CISA Known Exploited Vulnerabilities catalog (30 October 2026 edition).

Are you affected?

dpkg-query -W -f='${Package} ${Version}\n' 'exim4*'
apt policy exim4-daemon-light exim4-daemon-heavy
exim4 -bV | head -3
sudo exim4 -bP hosts_proxy
sudo exim4 -bP authenticators | grep -i driver
sudo exim4 -bP config | grep -nE 'json|utf8'

Bookworm builds older than 4.96-15+deb12u9 and trixie builds older than 4.98.2-1+deb13u2 are exposed to CVE-2026-45185. The PROXY fix needs at least 4.96-15+deb12u10 or 4.98.2-1+deb13u3.

How to update

sudo apt update
sudo apt install --only-upgrade exim4 exim4-base exim4-config exim4-daemon-light exim4-daemon-heavy
apt policy exim4-daemon-light

Only one daemon package is normally installed; --only-upgrade skips the one you do not have. On trixie this installs the newest Exim build, which also contains the later July and September fixes.

Restart or reboot?

No reboot. Restart Exim so the listening daemon uses the new binary, then check that it accepts mail:

sudo systemctl restart exim4
sudo systemctl status exim4 --no-pager
sudo exim4 -bt postmaster

Sources

• security-tracker.debian.org/tracker/DSA-6265-1
• debian.org/security/2026/dsa-6265
• lists.debian.org/debian-security-announce/2026/msg00176.html
• security-tracker.debian.org/tracker/DSA-6309-1
• debian.org/security/2026/dsa-6309
• lists.debian.org/debian-security-announce/2026/msg00220.html
• security-tracker.debian.org/tracker/DLA-4580-1
• security-tracker.debian.org/tracker/DLA-4615-1
• security-tracker.debian.org/tracker/CVE-2026-45185
• exim.org/static/doc/security/EXIM-Security-2026-05-01.1/EXIM-Security-2026-05-01.1.txt
• exim.org/static/doc/security/EXIM-Security-2026-05-19.1/EXIM-Security-2026-05-19.1.txt
• exim.org/static/doc/security/cve-2026-04.1
• cve.org/CVERecord?id=CVE-2026-45185
• cve.org/CVERecord?id=CVE-2026-40685
• cve.org/CVERecord?id=CVE-2026-48840
• cisa.gov/known-exploited-vulnerabilities-catalog
• packages.debian.org/source/trixie/exim4
• packages.debian.org/trixie/exim4-daemon-light
• manpages.debian.org/trixie/exim4-daemon-light/exim4.8.en.html