CVE-2023-51766
published 2023-12-24CVE-2023-51766: Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
1.10%
65.5th percentile
Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports . but some other popular e-mail servers do not.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | exim4 | < exim4 4.96-15+deb12u4 (bookworm) | exim4 4.96-15+deb12u4 (bookworm) |
| dovecot | dovecot | — | — |
| exim | exim | < 4.97.1 | 4.97.1 |
| fedoraproject | extra_packages_for_enterprise_linux | — | — |
| fedoraproject | extra_packages_for_enterprise_linux | — | — |
| fedoraproject | extra_packages_for_enterprise_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| ubuntu | exim4 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
dovecot: Dovecot: SMTP smuggling vulnerability allows spoofed email injection
vendor_redhat·2026-08-28·CVSS 5.3
CVE-2026-33604 [MEDIUM] CWE-93 dovecot: Dovecot: SMTP smuggling vulnerability allows spoofed email injection
dovecot: Dovecot: SMTP smuggling vulnerability allows spoofed email injection
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that hasn't yet fixed the SMTP smuggling vulnerability can be tricked into treating part of the message body as new SMTP commands, allowing injection of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. Where you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to non-vulnerable version. No publicly available exploits are known.
A flaw w
Ubuntu
Exim vulnerabilities
vendor_ubuntu·2026-06-03·CVSS 5.3
CVE-2026-40687 [MEDIUM] Exim vulnerabilities
Title: Exim vulnerabilities
Summary: Several security issues were fixed in Exim.
Timo Longin discovered that Exim incorrectly handled certain SMTP messages
in PIPELINING/CHUNKING configurations. A remote attacker could possibly use
this issue to perform SMTP smuggling. This issue only affected Ubuntu
14.04 LTS. (CVE-2023-51766)
It was discovered that Exim incorrectly handled certain malformed JSON
data in headers. A remote attacker could possibly use this issue to crash
Exim, resulting in a denial of service, or execute arbitrary code. This
issue only affected Ubuntu 20.04 LTS. (CVE-2026-40685)
It was discovered that Exim incorrectly handled certain malformed UTF-8
headers. A remote attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu
Ubuntu
Exim vulnerability
vendor_ubuntu·2024-01-29
CVE-2023-51766 Exim vulnerability
Title: Exim vulnerability
Summary: Exim could be made to bypass an SPF protection mechanism if it received
a specially crafted request.
It was discovered that Exim incorrectly handled certain requests.
A remote attacker could possibly use a published exploitation technique
to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass
of an SPF protection mechanism.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2023-51766: exim4 - Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configur...
vendor_debian·2023·CVSS 5.3
CVE-2023-51766 [MEDIUM] CVE-2023-51766: exim4 - Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configur...
Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports . but some other popular e-mail servers do not.
Scope: local
bookworm: resolved (fixed in 4.96-15+deb12u4)
bullseye: resolved (fixed in 4.94.2-7+deb11u2)
forky: resolved (fixed in 4.97-3)
sid: resolved (fixed in 4.97-3)
trixie: resolved (fixed in 4.97-3)
GHSA
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that pr
ghsa_unreviewed·2026-08-28·CVSS 5.3
CVE-2026-33604 [MEDIUM] CWE-655 An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that pr
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that hasn't yet fixed the SMTP smuggling vulnerability can be tricked into treating part of the message body as new SMTP commands, allowing injection of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. Where you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to non-vulnerable version. No publicly available exploits are known.
OSV
CVE-2023-51766: Exim before 4
osv·2023-12-24·CVSS 5.3
CVE-2023-51766 [MEDIUM] CVE-2023-51766: Exim before 4
Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports . but some other popular e-mail servers do not.
GHSA
GHSA-w6ww-869j-cgm6: Exim through 4
ghsa_unreviewed·2023-12-24
CVE-2023-51766 [MEDIUM] CWE-345 GHSA-w6ww-869j-cgm6: Exim through 4
Exim through 4.97 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages that appear to originate from the Exim server, allowing bypass of an SPF protection mechanism. This occurs because Exim supports . but some other popular e-mail servers do not.
Suricata
ET EXPLOIT Inbound Setup Message from SMTP Smuggling Tool
suricata·2024-01-05
CVE-2023-51764 ET EXPLOIT Inbound Setup Message from SMTP Smuggling Tool
ET EXPLOIT Inbound Setup Message from SMTP Smuggling Tool
Rule: alert smtp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Inbound Setup Message from SMTP Smuggling Tool"; flow:established,to_client; content:"From|3a 20|setup|5f|check|40|"; nocase; content:"To|3a 20|"; nocase; distance:0; content:"Subject|3a 20|SETUP|20|CHECK"; nocase; distance:0; content:"Date|3a 20|"; nocase; distance:0; content:"Message|2d|ID|3a 20|"; nocase; distance:0; content:"Your setup seems to be working! You can now proceed with smuggling tests!"; fast_pattern; nocase; distance:0; reference:cve,2023-51764; reference:url,github.com/The-Login/SMTP-Smuggling-Tools/blob/main/smtp_smuggling_scanner.py; reference:cve,2023-51766; reference:cve,2023-51765; classtype:trojan-activity; sid:2049923; rev:1; metadata:atta
Suricata
ET EXPLOIT Inbound Smuggling Message from SMTP Smuggling Tool M2
suricata·2024-01-05
CVE-2023-51764 ET EXPLOIT Inbound Smuggling Message from SMTP Smuggling Tool M2
ET EXPLOIT Inbound Smuggling Message from SMTP Smuggling Tool M2
Rule: alert smtp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Inbound Smuggling Message from SMTP Smuggling Tool M2"; flow:established,to_client; content:"From|3a 20|smuggled|40|"; nocase; content:"To|3a 20|"; nocase; distance:0; content:"Subject|3a 20|SMUGGLED|20|EMAIL"; nocase; distance:0; content:"Date|3a 20|"; nocase; distance:0; content:"Message|2d|ID|3a 20|"; nocase; distance:0; content:"SMUGGLING WORKS with"; nocase; distance:0; content:"as|20 22|fake|22 20|end|2d|of|2d|data|20|sequence|21|"; fast_pattern; nocase; distance:0; reference:cve,2023-51764; reference:url,github.com/The-Login/SMTP-Smuggling-Tools/blob/main/smtp_smuggling_scanner.py; reference:cve,2023-51766; reference:cve,2023-51765; classtype:trojan-
Suricata
ET EXPLOIT Inbound Smuggling Message from SMTP Smuggling Tool M1
suricata·2024-01-05
CVE-2023-51764 ET EXPLOIT Inbound Smuggling Message from SMTP Smuggling Tool M1
ET EXPLOIT Inbound Smuggling Message from SMTP Smuggling Tool M1
Rule: alert smtp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Inbound Smuggling Message from SMTP Smuggling Tool M1"; flow:established,to_client; content:"From|3a 20|test|40|"; nocase; content:"To|3a 20|"; nocase; distance:0; content:"Subject|3a 20|CHECK|20|EMAIL"; nocase; distance:0; content:"Date|3a 20|"; nocase; distance:0; content:"Message|2d|ID|3a 20|"; nocase; distance:0; content:"TESTING"; nocase; distance:0; content:"as|20 22|fake|22 20|end|2d|of|2d|data|20|sequence|21|"; fast_pattern; nocase; distance:0; reference:cve,2023-51764; reference:url,github.com/The-Login/SMTP-Smuggling-Tools/blob/main/smtp_smuggling_scanner.py; reference:cve,2023-51766; reference:cve,2023-51765; classtype:trojan-activity; sid:204992
No public exploits indexed.
Bugzilla
CVE-2026-33604 dovecot: Dovecot: SMTP smuggling vulnerability allows spoofed email injection [fedora-all]
bugzilla·2026-09-01·CVSS 5.3
CVE-2026-33604 [MEDIUM] CVE-2026-33604 dovecot: Dovecot: SMTP smuggling vulnerability allows spoofed email injection [fedora-all]
CVE-2026-33604 dovecot: Dovecot: SMTP smuggling vulnerability allows spoofed email injection [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that hasn't yet fixed the SMTP smuggling vulnerability can be tricked into treating part of the message body as new SMTP commands, allowing injection of spoofed email. This is the
Bugzilla
CVE-2026-33604 dovecot: Dovecot: SMTP smuggling vulnerability allows spoofed email injection
bugzilla·2026-08-28·CVSS 5.3
CVE-2026-33604 [MEDIUM] CVE-2026-33604 dovecot: Dovecot: SMTP smuggling vulnerability allows spoofed email injection
CVE-2026-33604 dovecot: Dovecot: SMTP smuggling vulnerability allows spoofed email injection
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that hasn't yet fixed the SMTP smuggling vulnerability can be tricked into treating part of the message body as new SMTP commands, allowing injection of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. Where you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to non-vulnerable version. No publicly available exploits are k
http://www.openwall.com/lists/oss-security/2023/12/24/1http://www.openwall.com/lists/oss-security/2023/12/25/1http://www.openwall.com/lists/oss-security/2023/12/29/2http://www.openwall.com/lists/oss-security/2024/01/01/1http://www.openwall.com/lists/oss-security/2024/01/01/2http://www.openwall.com/lists/oss-security/2024/01/01/3https://bugs.exim.org/show_bug.cgi?id=3063https://bugzilla.redhat.com/show_bug.cgi?id=2255852https://exim.org/static/doc/security/CVE-2023-51766.txthttps://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.htmlhttps://git.exim.org/exim.git/commit/5bb786d5ad568a88d50d15452aacc8404047e5cahttps://git.exim.org/exim.git/commit/cf1376206284f2a4f11e32d931d4aade34c206c5https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2023-51766https://lists.debian.org/debian-lts-announce/2024/01/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/https://lwn.net/Articles/956533/https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/https://www.openwall.com/lists/oss-security/2023/12/23/2https://www.youtube.com/watch?v=V8KPV96g1Tohttp://www.openwall.com/lists/oss-security/2023/12/24/1http://www.openwall.com/lists/oss-security/2023/12/25/1http://www.openwall.com/lists/oss-security/2023/12/29/2http://www.openwall.com/lists/oss-security/2024/01/01/1http://www.openwall.com/lists/oss-security/2024/01/01/2http://www.openwall.com/lists/oss-security/2024/01/01/3https://bugs.exim.org/show_bug.cgi?id=3063https://bugzilla.redhat.com/show_bug.cgi?id=2255852https://exim.org/static/doc/security/CVE-2023-51766.txthttps://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.htmlhttps://git.exim.org/exim.git/commit/5bb786d5ad568a88d50d15452aacc8404047e5cahttps://git.exim.org/exim.git/commit/cf1376206284f2a4f11e32d931d4aade34c206c5https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2023-51766https://lists.debian.org/debian-lts-announce/2024/01/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/https://lists.fedoraproject.org/archives/list/[email protected]/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/https://lists.fedoraproject.org/archives/list/[email protected]/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/https://lwn.net/Articles/956533/https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/https://www.openwall.com/lists/oss-security/2023/12/23/2https://www.youtube.com/watch?v=V8KPV96g1To
2023-12-24
Published