Re: CVE-2026-45185 - need more information and clarifications

On 16/05/2026 15.17, Jeremy Harris via Exim-users wrote:

>> "Affects: Exim 4.97 up to and including 4.99.2"  Does this mean that prior to 4.97 the bug was not there, or does this mean that no one cared to look for it, but the bug is in fact there since forever?
> We've not looked, not having the resouces for infinite back-version support. You should probably assume since the intro of chunking.

Thanks, I have checked and my unsupported versions are in Debian 9 and 10 (11 12 and 13 have patches ready). In Debian 9 and 10 chunking should be there (it was introduced in Exim 4.88) but still it's not advertised to remote hosts even without explicitly disabling it. I disabled it anyway to be sure.

Thanks again.

-- 
Fabio Muzzi

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki