CVE-2026-40684

MEDIUM

Exim < 4.99.2 - Denial of Service via Malformed DNS PTR Record

Title source: llm
STIX 2.1

Description

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.

References (6)

Core 6

Scores

CVSS v3 5.9
EPSS 0.0036
EPSS Percentile 27.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-684
Status published
Products (2)
Exim/Exim < 4.99.2
exim/exim < 4.99.2
Published Apr 30, 2026
Tracked Since May 01, 2026