Debian Updates Exim for SMTP Smuggling and Code Execution Flaws
Tech GuruQuick Answer
Debian 13's Exim update addresses SMTP smuggling and flaws that can expose information, crash the service, or execute code. DSA-6522-1 lists exim4 4.98.2-1+deb13u5 as fixed. Update the affected mail transport and test the actual proxy, TLS, and delivery paths it serves.
Confirm Scope And Apply The Supported Fix
Next step: Back up the configuration, record the mail queue and service state, and install the supported trixie security update. Plan service restarts so queued mail and dependent applications remain accounted for.
Last verified: 2026-09-28 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Debian 13 (trixie) exim4 packages before 4.98.2-1+deb13u5 |
|---|---|
| Advisory | DSA-6522-1 |
| CVEs | CVE-2026-94054, CVE-2026-94056, CVE-2026-94057 |
| Authoritative release date | 2026-09-27 19:24:22 UTC |
| Authority revision date | No separate material revision date stated by Debian; verified against the signed advisory announcement |
| Affected versions | Debian 13 (trixie) exim4 packages before 4.98.2-1+deb13u5 |
| Fixed version | exim4 4.98.2-1+deb13u5 for Debian 13 (trixie) |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
SMTP smuggling concerns disagreement over how a message or transaction is delimited. The advisory groups that risk with separate memory-safety issues; the prerequisites are not interchangeable. A normal test message checks basic delivery but does not alone validate all security boundaries.
What To Validate Now
- Inventory. Locate Debian 13 (trixie) systems and containers with exim4; record package version, repository, enabled services or consuming applications, exposure, owner, and dependencies.
- Establish applicability. Compare the installed package to DSA-6522-1 and the Debian Security Tracker. The advisory addresses the trixie package; do not infer scope for another Debian release or an upstream build.
- Remediate. Install exim4 4.98.2-1+deb13u5 for Debian 13 (trixie) through a supported Debian security repository, following Debian's current advisory and normal change control.
- Validate. Verify the running Exim build, inbound and outbound delivery, TLS, authentication, and intended relay restrictions with controlled accounts. Check proxy-protocol use and queue health where applicable. Keep malformed-message regression tests isolated from real recipients.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
