vcswatch reports that
there is an error with this package's VCS, or the debian/changelog file inside
it. Please check the error shown below and try to fix it. You might have
to update the VCS URL in the debian/control file to point to the correct
repository.
fatal: remote-curl: bad line length character: <!DO
fatal: expected flush after ref listing
CVE-2026-66140:
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
CVE-2026-66141:
Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.
CVE-2026-94054:
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
CVE-2026-94056:
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.
CVE-2026-94057:
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.
CVE-2026-66140:
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
CVE-2026-66141:
Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.
2 issues postponed or untriaged:
CVE-2026-40686:
(postponed; to be fixed through a stable update)
In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header data). Information might be divulged within an error message produced during handling of an unrelated e-mail message.
CVE-2026-40687:
(postponed; to be fixed through a stable update)
In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.
Depends on packages which need a new maintainer
normal
The packages that exim4 depends on which need a new maintainer are:
Lintian reports
3 warnings
about this package. You should make the package lintian clean getting rid of them.
debian/patches: 10 patches to forward upstream
low
Among the 19 debian patches
available in version 4.100.1-4 of the package,
we noticed the following issues:
10 patches
where the metadata indicates that the patch has not yet been forwarded
upstream. You should either forward the patch upstream or update the
metadata to document its real status.
testing migrations
This package is part of the ongoing testing transition known as auto-perl.
Please avoid uploads unrelated to this transition, they would
likely delay it and require supplementary work from the release
managers. On the other hand, if your package has problems
preventing it to migrate to testing, please fix them
as soon as possible.
You can probably find supplementary information in the
debian-release
archives or in the corresponding
release.debian.org
bug.
This package is part of the ongoing testing transition known as perl-5.44.
Please avoid uploads unrelated to this transition, they would
likely delay it and require supplementary work from the release
managers. On the other hand, if your package has problems
preventing it to migrate to testing, please fix them
as soon as possible.
You can probably find supplementary information in the
debian-release
archives or in the corresponding
release.debian.org
bug.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/e/exim4.png){kind=link}