Description

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.0",
  "pubDate": "2026-09-19T23:17:11.257Z",
  "pubdate": "2026-09-19T23:17:11.257Z",
  "executiveSummary": "Exim versions prior to 4.100.1 are susceptible to an SMTP smuggling vulnerability, a critical security flaw involving the improper handling of data termination sequences during SMTP communication.\nThis vulnerability allows a remote, unauthenticated attacker to bypass standard SMTP protocol constraints, potentially leading to unauthorized message injection or spoofing.\nThe issue arises from discrepancies between how Exim and subsequent receiving mail transfer agents (MTAs) interpret the end-of-data sequences within an SMTP stream.\nBy crafting specific data sequences that are interpreted differently by the receiving chain, an attacker can manipulate the perceived message content or inject additional messages into a transmission that was ostensibly rejected by the initial Exim instance.\nThis represents a significant risk to mail integrity and anti-spam filtering mechanisms, as attackers can effectively circumvent security controls by smuggling unauthorized commands or payloads through the Exim gateway.",
  "technicalDetails": "The root cause of the SMTP smuggling vulnerability in Exim lies in the inconsistent processing and validation of the DATA command termination sequence, specifically the sequence '<CR><LF>.<CR><LF>'. The flaw is triggered when the Exim MTA receives malformed or intentionally ambiguous data packets during the SMTP DATA phase.\nThe attack flow begins when an attacker initiates an SMTP connection to a vulnerable Exim server. During the DATA phase, the attacker transmits a message body containing a crafted sequence that simulates a message termination point. When the Exim server processes this input, it may encounter a rejection condition (e.g., policy or spam filtering); however, the handling of the underlying stream state allows the attacker to append additional data that is not properly discarded.\nIf the Exim server performs an implicit transition or fails to strictly terminate the session following the rejection, the trailing crafted data—which may contain a second, legitimate-looking SMTP command sequence—remains in the buffer or is forwarded to subsequent MTAs in the mail delivery chain.\nBecause downstream MTAs may interpret the byte-sequences differently than the initial Exim instance, the 'smuggled' data is parsed as a new, distinct message or command. This allows the attacker to bypass the security context of the initial transaction, effectively 'smuggling' an arbitrary message that appears to originate from an authorized source.\nThis exploitation does not require prior authentication, as it leverages the fundamental protocol handling logic within the SMTP implementation itself. It is a network-exposed vulnerability that does not necessitate high-level privileges on the target system; the capability resides in the attacker's ability to manipulate the byte-level construction of the SMTP stream.\nThe impact includes the ability to perform email spoofing, bypass DKIM/SPF signatures by injecting content post-validation, and potentially interfere with downstream security appliances that rely on the integrity of the SMTP session stream to perform analysis. Once the smuggled data reaches a downstream relay, the malicious payload is processed as a separate transaction, rendering the initial rejection by the Exim instance ineffective."
}