CVE-2025-26794 Affecting exim4 package, versions <4.98-4
Threat Intelligence
Exploit Maturity
Exploit maturity not defined.
Not Defined
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DEBIANUNSTABLE-EXIM4-8740798
- published22 Feb 2025
- disclosed21 Feb 2025
Introduced: 21 Feb 2025
NewCVE-2025-26794 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
How to fix?
Upgrade Debian:unstable exim4 to version 4.98-4 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream exim4 package and not the exim4 package as distributed by Debian.
See How to fix? for Debian:unstable relevant fixed versions and status.
Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.
References
- https://security-tracker.debian.org/tracker/CVE-2025-26794
- https://exim.org
- https://www.exim.org/static/doc/security/CVE-2025-26794.txt
- http://www.openwall.com/lists/oss-security/2025/02/19/1
- https://bugzilla.suse.com/show_bug.cgi?id=1237424
- https://code.exim.org/exim/exim/commit/bfe32b5c6ea033736a26da8421513206db9fe305
- https://github.com/Exim/exim/wiki/EximSecurity
- https://github.com/NixOS/nixpkgs/pull/383926
- https://github.com/openbsd/ports/commit/584d2c49addce9ca0ae67882cc16969104d7f82d
- http://www.openwall.com/lists/oss-security/2025/02/21/4
- http://www.openwall.com/lists/oss-security/2025/02/21/5