Exim patches four flaws with security release 4.100.1
The mail server's maintainers have shipped four advisories at once, and there is no workaround for the three that matter most.
The people who maintain Exim had a busy Friday. On 18 September the project published Exim 4.100.1 together with four security advisories, covering a heap out-of-bounds write, a leak of uninitialised stack memory, an SMTP smuggling flaw and a use-after-free - two of them rated high severity. The release went out at 12:00 UTC, which is also when the fix branch and tag were announced publicly.
What was fixed
The two high-severity issues both sit in Proxy Protocol handling, the extension mail servers use to learn a client's real address when something else sits in front of them. In the version 1 protocol an attacker can cause a read of roughly 230 bytes past the end of a heap allocation and write a single NUL byte at the end of it. In version 2 the server can be made to send stack memory it never initialised, leaking whatever happened to be there. Both require a build configured for Proxy Protocol and a proxy that is buggy or compromised, and neither has a workaround: the advice is simply to upgrade.
The second of those was reported by McCaulay Hudson of the security firm watchTowr, who is also credited with the SMTP smuggling flaw. That one needs a specific sequence - a rejection during the data phase followed by crafted data - to leave the receiving system handling a message that differs from the one the sender's server logged as sent. The fourth advisory is the mildest and the narrowest: a use-after-free reachable only on builds with GnuTLS 3.6.4 or later that have enabled the non-default tls_early_banner_hosts option, and turning that option off is enough to avoid it.
Who needs to move
Exim is one of the long-standing mail transfer agents, and this batch reaches back a long way: the Proxy Protocol flaws affect everything from 4.83 onwards, and the smuggling issue applies to every version up to and including 4.100. That is the awkward part of patch days like this one - the fixes are straightforward, but they land on mail servers that many administrators treat as appliances and upgrade rarely. Anyone running the affected versions should be reading the announcement rather than a summary of it, because the exposure differs by build options.
There is a detail in the advisories worth reading twice. Two of the four name no researcher at all, instead crediting the unnamed and uncredited authors whose work was ingested as the training corpus - a pointed line about AI-assisted bug hunting and the code it learns from. Whatever produced the reports, the project's timeline shows them arriving in August and September, fixes drafted within days, and the release tag signed and pushed to distributors three days before the public announcement.
Our opinion
Four advisories in a single release is not a sign of a project in trouble; it is a sign of one that batches disclosure rather than dribbling fixes out. The uncomfortable half is the mitigation column: for the Proxy Protocol bugs and the smuggling flaw, there is nothing to configure and nothing to switch off, so the only answer is the upgrade treadmill that small mail-server operators are worst at keeping up with. The reassurance is the credit line to watchTowr, which means these were found by people looking rather than by someone already using them in the wild. Mail servers are the plumbing of the internet, and plumbing only gets attention when it leaks.