CVE-2026-40684

Executive Summary

CVE-2026-40684 is a denial-of-service (DoS) vulnerability in Exim mail server versions prior to 4.99.2, exploitable only on systems linked against the musl libc (not glibc). A malformed DNS PTR record containing specific octal-escape sequences triggers a crash in the dn_expand resolver function, causing the affected connection instance to terminate. The vulnerability is remotely triggerable via a crafted email message that causes Exim to perform a reverse DNS lookup, resulting in a crash of the SMTP connection handler. The CVSS score is 5.9 (Medium), reflecting the moderate availability impact despite the relatively narrow platform precondition.

Technical Analysis

The vulnerability resides in Exim's interaction with the dn_expand function from the DNS resolver library. On musl libc systems, dn_expand has an oddity in how it handles octal-escaped characters during the expansion of compressed DNS names. When a PTR record contains malformed data — specifically, embedded octal escape sequences that cause dn_expand to generate a string with special formatting — the function returns an error in an inconsistent state.

Exim's DNS lookup code, located in src/dns.c, processes PTR records during reverse DNS resolution of connecting peers or recipient domains. The affected code path proceeds as follows:

1. Exim receives an incoming SMTP connection or message.
2. Exim performs a reverse DNS (PTR) lookup using dns_lookup().
3. The resolver returns a PTR record whose RDATA contains a name with embedded octal escapes (e.g., \000, \377).
4. dn_expand() (musl implementation) processes the name. Due to the octal-printing oddity, the function fails to properly terminate the output buffer or returns a byte count that exceeds the actual buffer size.
5. This inconsistency causes Exim to dereference an invalid pointer or read out of bounds, leading to a segmentation fault in the connection-handling child process.

The crash affects only the child process handling that specific connection, not the entire Exim daemon. However, an attacker can repeat this pattern across multiple connections to exhaust system resources (forked child processes, file descriptors) or disrupt mail delivery for legitimate users whose connections coincide with the attack.

The musl-specific nature of this bug is key: glibc's dn_expand implementation handles the octal-escape edge cases safely, while musl's implementation has a format-string-like flaw that does not properly sanitize output when expanding malformed DNS names.

Exploitation Scenarios

The attack chain proceeds as follows:

1) Reconnaissance and Target Identification

The attacker first identifies Exim servers running on musl libc. Common deployment scenarios include Alpine Linux mail servers, Docker containers based on Alpine, or other minimalist distributions. The attacker fingerprints the server:

nc -z target 25
echo -e "EHLO attacker.com\r\nQUIT\r\n" | nc target 25

The banner often reveals the Exim version. If the banner shows 220 with an Exim version string below 4.99.2, the server is potentially vulnerable. To confirm musl usage, the attacker may target Alpine-based containers (known to default to musl) or perform timing-based fingerprinting of connection handling.

2) Crafting the Malicious Payload

The attacker crafts an email message with a sender domain or recipient domain that resolves (via DNS) to a PTR record containing a malformed DNS name. Alternatively, the attacker can poison the DNS cache if they control a DNS server that the target Exim server queries. The malicious PTR record contains:

• A DNS message with a pointer to a name segment containing octal-escape bytes (e.g., \255, \000).
• The name is compressed using DNS pointer compression to ensure dn_expand() is invoked during parsing.

Example DNS wire-format for a malicious PTR record (simplified):

0xC0 0x0C  (pointer to offset 12)
...name bytes...
\x01  hex: 0x0F 0x01  (label length 1, byte 0x0F—octal escape trigger)
\x00  (terminator)

3) Triggering the Vulnerability

The attacker sends an email with a MAIL FROM: or RCPT TO: address whose domain triggers a PTR lookup. For example:

MAIL FROM:<attacker@evil.attacker-domain.com>

Alternatively, the attacker initiates a connection from an IP address whose reverse DNS maps to the malicious PTR record. Exim performs PTR lookups for:

• Connecting SMTP clients (to gather hostname information for logging and HELO validation).
• Domains in the message envelope (for callout verification).

4) Exploitation and Post-Exploitation Impact

When Exim processes the malicious PTR record, dn_expand() crashes the child process handling the connection. The attacker observes:

• The SMTP session terminates abruptly (connection reset).
• Repeated attacks cause resource exhaustion: each crash forces Exim to fork a new child process, increasing CPU and memory usage.

In a targeted DoS scenario, an attacker opens hundreds of connections simultaneously, each triggering the crash, causing the mail server to become unresponsive or to systematically reject legitimate mail during the attack window.

Impact Assessment

The vulnerability has a High impact on Availability (CVSS Availability subscore: 3.6), with no impact on Confidentiality or Integrity. The CVSS score is 5.9 (Medium), with Attack Vector: Network, Attack Complexity: High (musl libc requirement), and No Privileges Required.

Affected Systems:

• Exim versions < 4.99.2 running on musl libc.
• Common deployments: Alpine Linux mail servers, Docker containers based on Alpine images, IoT appliances with Exim linked against musl.
• Approximately 20-30% of public mail servers run Exim (based on recent internet scans), though only a subset of these use musl.

Blast Radius:

• Individual connection crashes — no data theft, no code execution, no privilege escalation.
• Potential for sustained service disruption if an attacker targets the server with repeated crash-inducing connections.
• Email delivery delays for legitimate users during the attack window.
• Enterprise impact: mail server availability is critical for business continuity, and a prolonged DoS can halt order processing, customer communications, and internal notifications.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H — Network-based attack, High complexity (musl requirement), no privileges, no user interaction, single-system scope (no change in security scope).

Detection Guidance

Sigma Rule

title: Exim Crash via Malformed DNS PTR Record (CVE-2026-40684)
id: 5f31a4eb-1db2-46c0-b67c-00d36b6a2d14
status: experimental
description: Detects suspicious SMTP connection patterns indicating repeated crashes in Exim child processes, potentially exploiting CVE-2026-40684.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-40684
author: ValtersIT Threat Intel
date: 2026/05/15
logsource:
    product: linux
    service: mail
detection:
    selection_crash:
        EventID: 'EXIM_PANIC'
        message|contains:
            - 'Segmentation fault'
            - 'Fatal error'
            - 'glibc detected'
            - 'dn_expand'
    selection_repeated:
        EventID: 'EXIM_SMTP_DISCONNECT'
        message|contains: 'connection reset by peer'
    condition: selection_crash and selection_repeated
    timeframe: 5m
level: high
falsepositives:
    - Legitimate Exim crashes due to unrelated bugs
    - Kernel OOM killer terminating Exim processes
tags:
    - attack.t1190
    - cve.2026-40684
    - dos

YARA Rule

rule CVE_2026_40684_Exim_DNS_Octal_Escape
{
    meta:
        author = "ValtersIT Threat Intel"
        date = "2026-05-15"
        description = "Detects DNS response packets containing malformed PTR records with octal-escape sequences targeting Exim (musl libc)."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-40684"
        severity = "medium"
    strings:
        $dns_ptr = { 00 0C }                          // PTR record type in DNS header
        $octal_255 = { C0 0C 01 FF }                  // Label length 1, byte 0xFF (octal escape trigger)
        $octal_000 = { C0 0C 01 00 }                  // Label length 1, null byte (truncation trigger)
        $dns_compress = { C0 }                        // Compression pointer present
    condition:
        $dns_ptr at 0 and ($octal_255 or $octal_000) and $dns_compress
}

Suricata IDS Rule

alert dns any any -> any any (msg:"CVE-2026-40684 Exim DNS PTR Malformed Octal Escape Attempt"; dns_query; content:"|0c|"; dns_type:PTR; content:"|c0 0c 01 ff|"; within:64; classtype:attempted-dos; reference:cve,2026-40684; sid:2026040684; rev:1;)

Elastic Detection

sequence by host.name with maxspan=5m
  [ network where dns.question.type == "PTR" and
    dns.answer.data : "*.\\[0-9]{1,3}\\.[0-9]{1,3}.*" and
    dns.answer.data : "*\\000*" or dns.answer.data : "*\\377*"
  ] by source.ip, destination.ip
  [ process where event.action == "end" and
    process.name : "exim*" and process.exit_code == 139
  ] by pid

Splunk SPL Query

index=main sourcetype=exim* 
| where match(_raw, "Segmentation fault|Fatal error|dn_expand failed") 
| stats count as crash_count by host, _time 
| timechart span=5m max(crash_count) as crashes by host 
| where crashes > 5 
| eval severity = "high", cve = "CVE-2026-40684" 
| table _time, host, crashes, severity, cve

Wazuh OSSEC Rule

<group name="exim_cve_2026_40684,">
  <rule id="100406" level="12" frequency="8" timeframe="300">
    <if_matched_sid>100405</if_matched_sid>
    <description>CVE-2026-40684: Repeated Exim crashes from smtp connections - possible DoS exploit</description>
    <group>exim,mail,cve,dos</group>
  </rule>

  <rule id="100405" level="8">
    <decoded_as>exim</decoded_as>
    <match>Segmentation fault|Fatal error|dn_expand|glibc detected</match>
    <description>Exim process crash - possible CVE-2026-40684 exploitation attempt</description>
    <group>exim,mail,cve,dos</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — Debian has claimed a patch; not independently confirmed).

1) Immediate Mitigations (if patching is not immediately possible):

• Restrict DNS access: If Exim is not required to perform reverse lookups, disable them by setting host_lookup = * to an empty list in the Exim configuration. This prevents PTR lookups entirely.
• Disable sender callout verification: Remove sender_verify = true from ACLs if callout verification is enabled, as this triggers DNS lookups on envelope domains.
• Firewall egress DNS filtering: Block outbound DNS queries from the Exim host to untrusted DNS servers. Ensure queries only go to trusted, internal resolvers.
• Rate-limit SMTP connections: Use fail2ban or iptables rate limiting to restrict the number of connections per IP, mitigating rapid crash-based DoS attempts.

2) Patch/Upgrade Steps:

• Upgrade to Exim 4.99.2 or later. The Debian patch is claimed to fix the dn_expand octal-printing issue on musl.
• For Debian-based systems:

  sudo apt update
  sudo apt upgrade exim4
  

• For Alpine Linux (musl default):

  apk update && apk upgrade exim
  

• For Docker-based deployments, rebuild the image from an updated base image and confirm the Exim version:

  exim -bV | grep "version"
  

• Verify patch installation:

  exim --version
  # Should show: version 4.99.2 or later
  

3) Long-Term Hardening:

• Standardize on glibc or patched musl: For critical mail servers, consider deploying on glibc-based distributions (Debian, Ubuntu, CentOS) to eliminate this class of bug entirely.
• Run Exim in a chroot or containerized sandbox with minimal privileges, reducing the impact of any connection-handler crash.
• Implement SMTP connection limits: Configure smtp_accept_max_per_host and smtp_accept_max in Exim to limit resource consumption during a DoS.
• Monitor DNS responses: Deploy DNS response validation (e.g., using named with DNSSEC) to reject malformed DNS data before it reaches Exim.
• Subscribe to Exim security announcements and vendor advisories for timely patch deployment.

References

1. NVD Entry — CVE-2026-40684: https://nvd.nist.gov/vuln/detail/CVE-2026-40684
2. Debian Security Tracker (patch source): https://security-tracker.debian.org/tracker/CVE-2026-40684
3. Exim Official Website and Release Notes: https://www.exim.org/
4. CWE-684 — Incorrect Provision of Specified Functionality: https://cwe.mitre.org/data/definitions/684.html
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-40684 NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: No known threat actor campaigns have been attributed to this CVE as of the publication date. The CVE is NOT listed in CISA's KEV catalog, EPSS score is low (0.00362), and no public PoC or exploit code has been released. The vulnerability is likely only of interest to opportunistic attackers targeting Alpine-based mail servers in DDoS-for-hire or hacktivist operations. SOC teams should treat this as a low-priority but watchlist-worthy CVE given the availability impact.