[{"data":1,"prerenderedAt":221},["ShallowReactive",2],{"seo-verification":3,"blog-exim-dovecot-patches-mail-server-vps-check-version-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-exim-dovecot-patches-mail-server-vps-check-version-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":27,"featuredImage":29,"bgImage":30,"posterImage":31,"relatedSolution":29,"intro":32,"sections":33,"ctaTitle":166,"ctaBody":167,"ctaButton":168,"ctaUrl":169,"relatedPosts":170},519,"exim-dovecot-patches-mail-server-vps-check-version",{"fr":12,"en":10,"ar":13,"es":14},"exim-dovecot-correctifs-serveur-mail-vps-verifier-version","exim-dovecot-تصحيحات-خادم-البريد-vps-التحقق-من-الإصدار","exim-dovecot-correcciones-servidor-correo-vps-comprobar-version","Exim and Dovecot: check that your package is truly patched","Exim 4.97 can be patched while the upstream fix is 4.100.1. Read the package changelog, test your exposure, restart the daemon, and check the logs.",9,0,false,"2026-10-28T00:00:00+00:00","2026-10-29T03:10:22+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},11,"Business Email","emails","bg-cyan-500\u002F10 text-cyan-400",[28],{"id":23,"name":24,"slug":25,"color":26,"icon":25},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fexim-dovecot-correctifs-serveur-mail-vps-verifier-version-poster.svg","The Ubuntu advisory of 28 September 2026 and the matching Debian advisory for Exim, then the Dovecot flaw of May 2026, quote version numbers that your commands cannot reproduce. `exim4 -bV` prints the upstream version, while a distribution fixes the flaw and keeps an older number: one Exim 4.97 can be protected, another not. This guide gives the method to read the package changelog, test your real exposure, restart the right process, and decide whether this mail server is worth running yourself.",[34,38,76,85,110,141,145,148,151,154,157,160,163],{"type":35,"title":36,"body":37},"h2","Why the version number does not answer the question","The upstream Exim fix carries the number 4.100.1: the Ubuntu entry for CVE-2026-94054 describes a flaw present in \"Exim before 4.100.1\". Yet Ubuntu 24.04 ships a package fixed in 4.97-4ubuntu4.8, and Ubuntu 22.04 one fixed in 4.95-4ubuntu2.12. Both are far below 4.100.1, and both are fixed.\n\nThe reason is mechanical. A distribution backports the fix into the older branch it maintains: the upstream number does not move, only the package revision, after the hyphen, changes. Comparing the output of `exim4 -bV` with 4.100.1 therefore raises a false alarm on a healthy server. The opposite exists too: an Exim compiled by hand, outside the package manager, has no distribution revision, and only its upstream number counts. The right question is not \"is my version high enough?\" but \"does my package contain the fixed revision, and does its changelog cite the CVE?\".",{"type":39,"title":40,"headers":41,"rows":45},"comparison","Fixed Exim packages by distribution (checked on 28 October 2026)",[42,43,44],"Distribution","Fixed exim4 package","Status recorded",[46,50,53,56,60,64,68,72],[47,48,49],"Ubuntu 26.04 LTS","4.99.1-1ubuntu1.5","Fixed (USN-8834-1)",[51,52,49],"Ubuntu 24.04 LTS","4.97-4ubuntu4.8",[54,55,49],"Ubuntu 22.04 LTS","4.95-4ubuntu2.12",[57,58,59],"Ubuntu 26.10","Not applicable","Not affected according to Ubuntu",[61,62,63],"Debian 13 (trixie), security repository","4.98.2-1+deb13u5","Fixed (DSA-6522-1)",[65,66,67],"Debian 12 (bookworm)","4.96-15+deb12u10","Marked vulnerable on 28 October 2026: re-read the tracker before acting",[69,70,71],"Debian forky and sid","4.100.1-4","Fixed",[73,74,75],"AlmaLinux, Rocky","Depends on the repository providing Exim","Read the package changelog",{"type":77,"title":78,"items":79},"ul","What Ubuntu advisory USN-8834-1 fixes",[80,81,82,83,84],"**CVE-2026-94054** — out-of-bounds write when Proxy-Protocol is used with an attacker-controlled proxy. Ubuntu scores it 7.0 in CVSS 3, priority Medium.","**CVE-2026-94056** — uninitialized stack read in the same Proxy-Protocol context, with possible information disclosure.","**CVE-2026-94057** — SMTP smuggling: data sent after a rejection during the DATA command allows message injection. No proxy is needed.","**CVE-2026-94055** — use-after-free with GnuTLS and non-default TLS settings. Only Ubuntu 26.04 was affected.","**A priority is not your risk** — the Medium priority judges the flaw in general. It does not tell whether your server accepts connections through a proxy: the tests below do.",{"type":86,"title":87,"steps":88},"steps","Checking an Exim package, command by command",[89,92,95,98,101,104,107],{"title":90,"body":91},"Read the raw version","`exim4 -bV` prints the upstream Exim version (the binary is called `exim` on other systems). Note it, but conclude nothing: this is the number that cannot be compared with 4.100.1.",{"title":93,"body":94},"Read the package revision","`dpkg -s exim4-daemon-light | grep Version` gives the installed revision. Swap the name for `exim4-daemon-heavy` if that is your variant, and list them with `dpkg -l 'exim4*'`. Compare with the reference table.",{"title":96,"body":97},"Look for the CVE in the changelog","`apt changelog exim4 | grep -n CVE-2026-94054`. A matching line means the fix is in the package. No line: run the update, then repeat the command.",{"title":99,"body":100},"On AlmaLinux or Rocky","`rpm -q --changelog exim | grep CVE` does the same job, provided the package comes from a repository that publishes it. Same logic for Dovecot with `rpm -q --changelog dovecot | grep CVE-2026-42006`.",{"title":102,"body":103},"Ask the distribution","On Debian, `debsecan` lists the known CVEs for installed packages. On Ubuntu, `ubuntu-security-status` summarizes which packages still receive security fixes; it does not target one CVE.",{"title":105,"body":106},"Update","`sudo apt update && sudo apt install --only-upgrade 'exim4*'`, then the same command with `'dovecot*'` if Dovecot runs on the machine.",{"title":108,"body":109},"Check the loaded process","`ls -l \u002Fproc\u002F$(pgrep -o exim4)\u002Fexe`. The mention (deleted) shows the binary was replaced on disk while the old one still runs in memory. Restart with `sudo systemctl restart exim4`.",{"type":39,"title":111,"headers":112,"rows":116},"Checking and fixing by environment",[113,114,115],"Environment","Check","Fix",[117,121,125,129,133,137],[118,119,120],"Debian, Ubuntu","`dpkg -s exim4-daemon-light | grep Version`","`sudo apt update && sudo apt install --only-upgrade 'exim4*' 'dovecot*'`",[122,123,124],"AlmaLinux, Rocky (Dovecot)","`rpm -q --changelog dovecot | grep CVE-2026-42006`","`sudo dnf upgrade dovecot`",[126,127,128],"AlmaLinux, Rocky (Exim outside the base repositories)","`rpm -q --changelog exim | grep CVE-2026-94054`","Update through the repository that provides it, or wait for its fix",[130,131,132],"Docker (Exim or Dovecot image)","`docker exec \u003Ccontainer> exim -bV`","`docker pull \u003Cimage>` then recreate the container",[134,135,136],"Mailcow","`docker compose exec dovecot-mailcow dovecot --version`","`.\u002Fupdate.sh` in the Mailcow folder",[138,139,140],"Compiled by hand","`exim -bV`","Recompile from a fixed upstream version, or switch to the distribution package",{"type":142,"title":143,"body":144},"tip","Updating does not replace the running process","After the update, a daemon that is already running keeps executing the old binary. Restart with `sudo systemctl restart exim4` and `sudo systemctl restart dovecot`, or let `needrestart` offer it. For Ubuntu 20.04 and earlier, the Ubuntu entry shows a \"needs evaluation\" status: without a fixed package, plan an OS migration rather than waiting.",{"type":35,"title":146,"body":147},"Are you exposed: the Proxy-Protocol test","Two of the four CVEs require Proxy-Protocol. In Exim it is enabled by the main option `hosts_proxy`. Without it, no ordinary client reaches the code involved in CVE-2026-94054 and CVE-2026-94056. Test with `exim4 -bP hosts_proxy`.\n\nAn empty value means no host is declared as a proxy; an unknown-option message may come from a build without this support: check it in your build's documentation. A list of addresses means those hosts speak Proxy-Protocol: the risk then depends on how far you trust them, since the flaw assumes an attacker-controlled proxy. This test does not cover CVE-2026-94057, the SMTP smuggling, which applies without a proxy, nor CVE-2026-94055, tied to GnuTLS and non-default TLS settings on Ubuntu 26.04. For those, the update remains the only defense.",{"type":35,"title":149,"body":150},"If your distribution has no fixed package yet","The table shows it: on 28 October 2026, Debian 12 was still marked vulnerable for Exim. Waiting with no action is not the only option. Start by reducing what is reachable: if `exim4 -bP hosts_proxy` returns an empty value, the two Proxy-Protocol flaws cannot be reached by an ordinary client, and you gain time on them. For the rest, limit the allowed sources on port 25 when your usage permits, and watch your distribution tracker until the package is published.\n\nRebuilding Exim from upstream sources is possible, but you then become the only maintainer of that binary: no `apt upgrade` will ever fix it again. Keep this choice for a team that accepts that follow-up. If the distribution is out of support, the lasting way out is a migration to a maintained version, to be planned rather than endured.",{"type":35,"title":152,"body":153},"Dovecot: CVE-2026-42006 and sources that do not agree","CVE-2026-42006 describes unbounded memory use when an IMAP client sends excessive opening braces. It bypasses the fix for CVE-2026-27857; according to the Debian tracker, that fix only blocked closing braces. Dovecot.org published it on 12 May 2026 with a Moderate severity, but lists neither affected nor fixed versions: the site points to the Open-Xchange advisory.\n\nDebian gives precise packages: 1:2.3.19.1+dfsg1-2.1+deb12u6 for bookworm and 1:2.4.1+dfsg1-6+deb13u7 for trixie in the security repository. The tracker lists another revision for trixie outside the security repository: when two revisions coexist, check the one your `apt` installs with `apt-get changelog dovecot-core | grep CVE-2026-42006`. Deduce nothing from `dovecot --version` alone. If the update has to wait, the documented mitigation is a low `vsz_limit` value for the imap process: it caps the memory a client can consume.",{"type":155,"body":156},"p","Two sources stay silent or disagree, and it is better to know it. Dovecot.org does not publish fixed versions, where Debian gives them per distribution. And the exim.org security page did not index these CVEs when we checked on 28 October 2026: we therefore cite no upstream date for Exim. The distribution advisories, Ubuntu and Debian, are what decide your package.",{"type":35,"title":158,"body":159},"Checking the logs after the fix","Fixing does not tell whether someone came by earlier. Look for abnormal stops since the advisory: `journalctl -u exim4 --since \"2026-09-28\" | grep -i -E 'segfault|signal|core dumped'`, then `journalctl -k --since \"2026-09-28\" | grep -i -E 'segfault|out of memory'`. On the Dovecot side, `journalctl -u dovecot --since \"2026-09-28\" | grep -i -E 'out of memory|killed'` spots an imap process killed for lack of memory.\n\nAlso read the Exim log (`\u002Fvar\u002Flog\u002Fexim4\u002Fmainlog` on Debian and Ubuntu) for messages sent from senders you do not know. No trace proves nothing: a memory leak leaves no line. Keep these commands as a routine check after each advisory, not as proof of innocence.",{"type":35,"title":161,"body":162},"Who keeps a mail server patched?","Fixing an exposed MTA seems reserved for a system administrator. The procedure above takes a few commands and replays on every advisory: read the changelog, update, restart, check the process. The real cost is vigilance, meaning following the USN and DSA notices, testing, and never leaving a machine aside.\n\nOn a ServOrbit VPS you get root access and a choice of OS (Ubuntu, Debian, AlmaLinux, Rocky). If you do not want to keep these fixes up yourself, the VPS administration option exists, to be subscribed separately. This guide is provided as is, without support for your configuration. And if your goal is only to have professional addresses, professional email spares you from running an MTA.",{"type":35,"title":164,"body":165},"Official documentation","Ubuntu notice USN-8834-1 (Exim): https:\u002F\u002Fubuntu.com\u002Fsecurity\u002Fnotices\u002FUSN-8834-1\n\nUbuntu entry for CVE-2026-94054: https:\u002F\u002Fubuntu.com\u002Fsecurity\u002FCVE-2026-94054\n\nDebian tracker for CVE-2026-94054: https:\u002F\u002Fsecurity-tracker.debian.org\u002Ftracker\u002FCVE-2026-94054\n\nDebian tracker for CVE-2026-42006: https:\u002F\u002Fsecurity-tracker.debian.org\u002Ftracker\u002FCVE-2026-42006\n\nDovecot security page: https:\u002F\u002Fdovecot.org\u002Fsecurity\n\nOpen-Xchange advisory oxdc-adv-2026-0002: https:\u002F\u002Fdocumentation.open-xchange.com\u002Fdovecot\u002Fsecurity\u002Fadvisories\u002Fhtml\u002F2026\u002Foxdc-adv-2026-0002.html\n\nExim proxy support (`hosts_proxy`): https:\u002F\u002Fwww.exim.org\u002Fexim-html-current\u002Fdoc\u002Fhtml\u002Fspec_html\u002Fch-proxies.html\n\nExim security page: https:\u002F\u002Fwww.exim.org\u002Fstatic\u002Fdoc\u002Fsecurity\u002F","A VPS of your own, with root and your choice of OS","A ServOrbit VPS gives you root access, a dedicated IPv4 and a choice of OS (Ubuntu, Debian, AlmaLinux, Rocky). If you do not want to keep an exposed mail server patched yourself, the VPS administration option exists; otherwise, professional email spares you from running an MTA.","See Cloud VPS","\u002Fvps-cloud",[171,188,204],{"id":172,"slug":173,"slugs":174,"title":178,"excerpt":179,"readTime":180,"views":181,"isPinned":19,"publishedAt":182,"updatedAt":183,"category":184,"categories":185,"featuredImage":29,"bgImage":30,"posterImage":187,"relatedSolution":29},238,"hosting-your-own-email-server-on-a-vps-with-mailcow",{"fr":175,"en":173,"ar":176,"es":177},"heberger-serveur-email-vps-mailcow","استضافة-خادم-البريد-الإلكتروني-على-vps-باستخدام-mailcow","alojar-servidor-correo-vps-mailcow","Hosting Your Own Email Server on a VPS with Mailcow","Deploy Mailcow on a Linux VPS to run your own sovereign email server: installation, deliverability and migration from Google Workspace.",20,3,"2026-08-08T00:00:00+00:00","2026-10-29T03:10:23+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},[186],{"id":23,"name":24,"slug":25,"color":26,"icon":25},"\u002Fblog\u002Fcovers\u002Fheberger-serveur-email-vps-mailcow-poster.svg",{"id":189,"slug":190,"slugs":191,"title":195,"excerpt":196,"readTime":197,"views":18,"isPinned":19,"publishedAt":198,"updatedAt":199,"category":200,"categories":201,"featuredImage":29,"bgImage":30,"posterImage":203,"relatedSolution":29},459,"self-hosted-email-server-on-vps-comparison-2026",{"fr":192,"en":190,"ar":193,"es":194},"serveur-email-self-hosted-comparatif-vps-2026","مقارنة-خوادم-البريد-self-hosted-على-vps-2026","comparativa-servidores-email-self-hosted-en-vps-2026","Self-hosted email server on VPS: 2026 comparison","Stalwart, Mailcow or Postfix+Dovecot: compare RAM, complexity and spam filtering scope to choose the right email server for your VPS in under 10 minutes.",10,"2026-10-16T00:00:00+00:00","2026-10-18T21:57:56+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},[202],{"id":23,"name":24,"slug":25,"color":26,"icon":25},"\u002Fblog\u002Fcovers\u002Fserveur-email-self-hosted-comparatif-vps-2026-poster.svg",{"id":205,"slug":206,"slugs":207,"title":211,"excerpt":212,"readTime":213,"views":214,"isPinned":19,"publishedAt":215,"updatedAt":216,"category":217,"categories":218,"featuredImage":29,"bgImage":30,"posterImage":220,"relatedSolution":29},280,"postfix-smtp-relay-on-vps-client-transactional-emails",{"fr":208,"en":206,"ar":209,"es":210},"smtp-relay-vps-emails-transactionnels-clients","إعداد-postfix-smtp-relay-على-vps-لبريد-المواقع","relay-smtp-postfix-en-vps-emails-transaccionales","Postfix SMTP Relay on VPS: Client Transactional Emails","Set up Postfix as an SMTP relay on a ServOrbit VPS: dedicated IPv4, SPF, DKIM and DMARC aligned for your entire cPanel client portfolio in under an hour.",8,1,"2026-08-18T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},[219],{"id":23,"name":24,"slug":25,"color":26,"icon":25},"\u002Fblog\u002Fcovers\u002Fsmtp-relay-vps-emails-transactionnels-clients-poster.svg",1793251325216]