CVE-2026-40684
Medium · 5.9CVSS
5.9
EPSS
0.6%
Published
Apr 30, 2026
CISA due date
—
The record
In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-79126 Incorrect provision of specified functionality in Proxy in Google Chrome on on Windows… CWE-684
- CVE-2026-52735 ZEBRA is a Zcash node written entirely in Rust. CWE-684
- CVE-2026-44597 Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell… CWE-684
- CVE-2026-42255 Technitium DNS Server before 15.0 allows DNS traffic amplification via cyclic name server… CWE-684
- GHSA-532v-xp3f-837c uutils coreutils has an Incorrect Provision of Specified Functionality Issue in its cut… CWE-684
- GHSA-fhr3-xh3q-69w6 uutils coreutils has an Incorrect Provision of Specified Functionality Issue CWE-684
- CVE-2026-35381 A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s… CWE-684
- CVE-2026-35379 A logic error in the tr utility of uutils coreutils causes the program to incorrectly… CWE-684