What is GHSA-3mrg-v8x6-xfjw?

GHSA-3mrg-v8x6-xfjw is a security advisory published by GitHub Security Advisories with Medium severity. Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent...

Which CVE IDs does GHSA-3mrg-v8x6-xfjw cover?

GHSA-3mrg-v8x6-xfjw covers the following CVE IDs: CVE-2026-94057. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3mrg-v8x6-xfjw?

GHSA-3mrg-v8x6-xfjw has a CVSS v3 base score of 4.0, published by GitHub Security Advisories.

GHSA-3mrg-v8x6-xfjwMediumCVSS 4.0

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent...

Vendor

GitHub Security Advisories

Published

September 20, 2026

Last Modified

September 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-94057 →

📋 Description

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-94057
https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html
https://github.com/advisories/GHSA-3mrg-v8x6-xfjw