Servers and applications
CVE-2023-51766
Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not.
- Severity
- Medium 5.3
- Published
- 24 Dec 2023
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 4.97.1
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
EximServers and applications · cpe:a:exim:exim |
|