Debian LTS exim4 Important Info Disclosure Fix DLA-4615-1 CVE-2026-48840

Warisjeet Singh discovered that Exim, a mail transport agent, does not
properly handle PROXY frames whose declared payload length is too short
for the claimed address family, which may result in information
disclosure in configurations with SUPPORT_PROXY and 'host_proxy' set.


For Debian 11 bullseye, this problem has been fixed in version
4.94.2-7+deb11u6.

We recommend that you upgrade your exim4 packages.

For the detailed security status of exim4 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/exim4

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS