exim-4.99.2 in exim/exim released

*@toolsmith* released exim-4.99.2 ( https://code.exim.org/exim/exim/releases/tag/exim-4.99.2 ) in exim/exim ( https://code.exim.org/exim/exim )

Title: exim-4.99.2

Note:

This is a security release.

It fixes the following vulnerabilities.

CVE-2026-40684 Possible crash with malicious DNS data when using musl libc

On systems using musl libc (not glibc) due to an oddity in octal printing
it is possible to crash the connection instance when malformed DNS data
is present in PTR records.

CVE-2026-40685 Possible OOB read/write on corrupt JSON in header

configurations using json operators on invalid externally-provided input
could trigger heap corruption.

CVE-2026-40686 Possible OOB read with large UTF8 trailing characters

configurations using utf8 operators on malformed utf8 in headers could
trigger OOB reads and might trigger some data leak if error
messages are required for subsequent emails in the current connection
and similar malformed headers are present.

CVE-2026-40687 Possible OOB read/write with SPA authenticator

in configurations using the SPA authentication driver to a hostile/compromised
external SPA/NTLM connnection it is possible to trigger an OOB read/write
and crash the connection instance or possibly leak heap data to the instance.

---
Downloads:

* *Source Code (ZIP)* ( https://code.exim.org/exim/exim/archive/exim-4.99.2.zip )
* *Source Code (TAR.GZ)* ( https://code.exim.org/exim/exim/archive/exim-4.99.2.tar.gz )

---
View it on Exim Forgejo ( https://code.exim.org/exim/exim/releases/tag/exim-4.99.2 ).