CVE-2026-40684

Katalog CVE

CVSS 7.5 · High EPSS 0,61%

Kerentanan Incorrect Provision of Specified Functionality pada exim. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.

Rincian

Terbit di NVD

30 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-684: Incorrect Provision of Specified Functionality

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40684.assessment advisory vendor
• https://code.exim.org/exim/exim/commit/628bbaca7672748d941a12e7cd5f0122a4e18c81 patch
• https://www.openwall.com/lists/oss-security/2026/04/30/21 mailing list · advisory pihak ketiga
• https://exim.org/static/doc/security/CVE-2026-40684.txt broken link
• http://www.openwall.com/lists/oss-security/2026/05/01/11