Flash Sale:75% Off Hosting + Free DomainEnds in13h47m14sView Plans
Hostvento logoHostvento
Get Started

Exim CVE-2026-45185 ("Dead.Letter"): What Mail Server Admins Should Do

A critical Exim flaw can give attackers remote code execution on your mail server. Check your version and update.

Email3 min read

What is it?

CVE-2026-45185, called "Dead.Letter", is a use-after-free bug in the way Exim handles the message body of the BDAT command (SMTP chunking). A client can trigger it by sending a TLS close_notify alert while a BDAT transfer is running, with one more byte of plain text on the same connection. An attacker may then run code with the rights of the Exim process.

Exim 4.99.3 fixes the problem. Version 4.99.4 added more improvements.

Who is affected?

  • Exim versions 4.97 to 4.99.2, built with USE_GNUTLS=yes.
  • Exim on VPS, dedicated mail servers, shared hosting nodes and cPanel/WHM servers built with GnuTLS and not OpenSSL.
  • Servers that offer the CHUNKING / BDAT extension. Check both the build options and the run-time settings.

Risk

An unauthenticated remote attacker may get remote code execution as the Exim process. That can lead to mail interception, server compromise, data theft and attacks on the rest of your network. The CVSS v3.1 base score is 9.8 (Critical).

Check your server

Show the version and build options:

exim -bV

or, on Debian and Ubuntu:

exim4 -bV

You can also list the installed package:

apt policy exim4
dpkg -l | grep exim

Treat the server as vulnerable if it uses GnuTLS and its version is in the range 4.97-4.99.2. Also look in your configuration and logs for BDAT or CHUNKING in SMTP sessions.

Patch it

Update to Exim 4.99.3 or newer.

Debian and Ubuntu

apt update && apt install --only-upgrade exim4
systemctl restart exim4

Check that exim4 -bV shows 4.99.3 or higher.

RHEL, CentOS, AlmaLinux and Rocky Linux

dnf update exim
systemctl restart exim

(Use yum update exim on older systems.) Check the version:

rpm -qa | grep exim
exim -bV

Alpine Linux

apk update && apk upgrade exim

Then run exim -bV and restart the service.

Built from source

Follow your change control process. Get the source of 4.99.3 or newer, rebuild with the same build options (and update the GnuTLS libraries if advised), and check that exim -bV shows the new version.

cPanel servers. cPanel manages Exim for you. Run the normal cPanel update (/scripts/upcp) and check the Exim version afterwards.

Test after the update

  • Send and receive test mail: SMTP submission, incoming mail and local delivery.
  • Make sure Exim starts without errors or crashes (core dumps).
  • Look in the logs from before the update for signs of abuse:

- strange commands in SMTP sessions - unusual script runs - odd BDAT or TLS errors - problems with local accounts - strange items or a sudden growth in the mail queue

If you cannot patch right now

  • Turn off the CHUNKING / BDAT extension in the Exim configuration, if your version allows it.
  • Limit who can reach port 25, 465 and 587 where possible.
  • Watch the logs closely until you can update.

Quick recap

  • Exim 4.97-4.99.2 with GnuTLS is vulnerable.
  • Update to 4.99.3 or newer and restart Exim.
  • Check the logs for signs of abuse.