CVE-2020-28018

—

CVSS 3.1

9.8 critical

EPSS

57%p99

Published

May 6, 2021 (May 6, 2021)

Modified

Jun 17, 2026

Description

Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.

Vendors: exim
Products: exim
Weakness: CWE-416
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (56.8%)

In the news4 stories

21 vulnerabilities found in Exim, update your instances ASAP!

Help Net SecurityJan 19, 11:45 UTC · Jan 19, 2023Vulnerability CVE-2020-28017 CVE-2020-28020 CVE-2020-28023+15 CVEs

60

ALERT — New 21Nails Exim Bugs Expose Millions of Email Servers to Hacking

The Hacker NewsMay 8, 11:47 UTC · May 8, 2021Vulnerability in the wildCVE-2020-28017 CVE-2020-28007 CVE-2020-28008+19 CVEs

60

Most of Exim email servers could be hacked by exploiting 21Nails flaws

Security AffairsMay 4, 17:10 UTC · May 4, 2021Vulnerability CVE-2020-28007 CVE-2020-28008 CVE-2020-28014+21 CVEs

60

21Nails vulnerabilities impact 60% of the internet's email servers

The RecordDec 7, 00:00 UTC · Dec 7, 2022Vulnerability CVE-2020-28007 CVE-2020-28008 CVE-2020-28014+21 CVEs

47