CVE-2025-26794
Fixed in a distro release EPSS 77%CVSS 7.5
Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)
Products: exim
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 13 | exim4 | 4.98-4 |
| Debian 14 | exim4 | 4.98-4 |
| Ubuntu 20.04 LTS | exim4 | 4.93-13ubuntu1.12 |
| Ubuntu 22.04 LTS | exim4 | 4.95-4ubuntu2.6 |
| Ubuntu 24.04 LTS | exim4 | 4.97-4ubuntu4.2 |
| openSUSE Tumbleweed | exim | 4.98.2-1.1 |