CVE-2023-51766: Debian Linux

Medium severity, CVSS 5.3. EPSS: 1.1% chance of exploitation in the next 30 days.

Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not.

Affected products

• Debian Debian Linux: version 10.0 only
• Exim Exim: before 4.97.1 (fixed in 4.97.1)
• Fedoraproject Extra Packages For Enterprise Linux: version 7.0 only; version 8.0 only; version 9.0 only
• Fedoraproject Fedora: version 38 only; version 39 only

Published 2023-12-24. Last modified 2026-06-17.