CVE-2025-26794 is a High severity (CVSS 7.5) SQL injection in the Exim mail server, version 4.98 before 4.98.1, when SQLite hints and ETRN serialization are in use. Update to 4.98.1. The record adds that some non-default rate limit setups need 4.99.1 to fully resolve it.
What's affected
The record describes Exim 4.98 before 4.98.1, in setups where SQLite is used for the hints database and ETRN serialization is turned on. The fix is 4.98.1.
The record adds a caveat in parentheses: resolving the SQL injection requires an update to 4.99.1 in certain non-default rate limit configurations. If you use rate limit features and SQLite hints together, plan for 4.99.1 or later and read the Exim security notes.
Distribution packages often backport fixes without changing the upstream version number. A Debian, Ubuntu, Red Hat or SUSE package may show an older looking version and still contain the fix, so check the distribution's own advisory for the exact package version.
How to check if you're exposed
Start with the version and build features your server reports:
exim -bV
The output lists the Exim version and compiled in features. Look at whether your build uses SQLite for the hints database, because the record ties the problem to that case. Then check your configuration for ETRN handling and for rate limit controls:
exim -bP | grep -i etrn
grep -rn "ratelimit" /etc/exim4 /etc/exim 2>/dev/null
Paths differ by distribution, so adjust them. On a package based install, query the package manager for the installed build and compare it against your vendor's advisory:
dpkg -l exim4* 2>/dev/null
rpm -q exim 2>/dev/null
If you run Exim with the default hints database and no SQLite, the record's conditions do not describe your setup, but upgrading is still sensible.
What to do now
- Inventory every Exim host, including relay and outbound only machines that people forget about.
- Check whether each one runs 4.98 and whether SQLite hints and ETRN serialization are enabled.
- Upgrade to 4.98.1 at minimum. If you use rate limits with SQLite hints, move to 4.99.1 or later as the record advises.
- If you cannot upgrade immediately, review whether ETRN is needed at all and restrict who may issue it.
- Confirm the fix using your distribution's advisory, since backported packages keep the old upstream number.
- Watch the mail logs for unexpected ETRN activity and unusual database errors until the update lands.
Why it matters
The record lists CWE-89 for this issue. SQL injection happens when text from a remote party ends up inside a database query as code instead of data. In a mail server the remote party is anyone who can open an SMTP connection, which makes the input surface very wide.
The CVSS vector rates availability impact as high and confidentiality and integrity as none, so the scored outcome is disruption, not data theft. That is a sensible reading for a hints database, which holds delivery and rate state, but mail is often critical infrastructure and a service that stops delivering is an incident. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog.
The caveat about 4.99.1 shows how an incomplete first fix can leave a second path open. When a patch is announced, read the release notes for follow up work and do not stop at the first version number you see.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need 4.99.1 or is 4.98.1 enough?
The record says 4.98.1 fixes the main issue, and that certain non-default rate limit configurations need 4.99.1 to resolve the SQL injection. If you use rate limits with SQLite hints, go to 4.99.1 or later.
Is my default Exim install affected?
The record ties the issue to SQLite hints and ETRN serialization. Check your build and configuration. If neither applies, the described conditions are not met, but a routine upgrade is still good practice.
Sources
Last reviewed: 19 October 2026.
