CVE-2026-40684CWE-684

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records

Medium · published April 30, 2026

CVSS v3.1
5.9
EPSS
1%
Percentile
48.4
In the wild
Unconfirmed
What it is

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00607 · 48.4th percentile
Weakness
CWE-684 · Incorrect Provision of Specified Functionality
Published
2026-04-30T00:00Z
EPSS history
Timeline
  • 30 APR 00:00Z
    In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records
    cvelistv5