Exim

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $15,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. Exim sits in Tier 1, where a secure-by-design memory-safety change carries a 2x multiplier until the end of 2026; the figure here is the un-multiplied one. Google's scope file still links the archived GitHub mirror, so the patch has to go to code.exim.org. Patches must be between one and twelve months old, the maintainers hold a veto, the panel may split the award with them, and it is rate-limited to three submissions a month. Sanctions and territory exclusions apply. CVE history 12 Last 12 months 97 Lifetime Memory safety 40 % Parsing/validation 25 % Code execution 20 % Auth bypass 10 % Latest advisories Loading the feed Overview Exim is the mail transfer agent bundled with cPanel, which puts it on an enormous share of the world's shared-hosting servers, and internet-facing MTA surveys have repeatedly put it at or near the largest single share of reachable SMTP servers. Its exposure profile is unusually bad: those hosts face the internet directly, are rarely patched promptly, and run what is historically a single setuid-root binary. CVE-2019-10149, Return of the WIZard, is the reference point. It was mass-exploited, and the NSA published an advisory on Sandworm exploitation of Exim in 2020. The project pays nothing for a vulnerability report; reports go to [email protected] . sorona.xyz pays you directly on qualified, reproduced findings. In scope Reports go to [email protected] and cover upstream Exim itself, with the live tree at code.exim.org rather than the archived GitHub mirror. Nothing narrower than the MTA is carved out The SMTP receive path in full, from connection through to acceptance, including every ACL and every command the peer can issue The string-expansion machinery and string_format , the engine that Exim's configuration language runs on and historically the source of its worst bugs Header, envelope and address parsing, including the buffer handling and integer arithmetic where a length or offset computation can wrap and a later copy trusts the result Exim's privilege model, which traditionally runs as a single setuid-root binary and so converts a parser bug straight into root Authentication and access control in the SMTP conversation: the authenticators, relay control, and anything that gets Exim to accept, relay or attribute mail it should have refused Message authentication and transport security as Exim implements them: DKIM, SPF, DMARC handling and TLS certificate and chain validation The routers and transports as a whole, covering delivery, address rewriting, aliasing and forwarding, plus the local-delivery paths that run as another user Queue handling and the spool, including race conditions that let a queued message be delivered, rewritten or dropped in a way the operator never configured The lookup and database layer, dnsdb , LDAP, SQL and file lookups among it, where attacker-influenced strings reach another parser Out of scope A vulnerability report on its own where the patch money is concerned: that rail pays only on a change merged upstream that then survives a month without reverts One-liner patches that fix non-exploitable crashes, and denial of service by resource exhaustion, which the rules exclude by name Patches the Exim maintainers decline, since Google explicitly declines to second-guess a maintainer's decision Patches submitted before the one-month no-revert window has elapsed, or older than twelve months, and anything past three submissions per person per month Configuration-error findings in third-party Exim deployments, including the cPanel default configuration, rather than defects in Exim itself Patches proposed against the archived github.com/Exim/exim mirror rather than the live upstream at code.exim.org Most-valued findings A secure-by-design memory-safety improvement across the SMTP receive path or the string-expansion machinery. Memory safety is the largest class here at 40 percent, and this is the only work carrying the Tier 1 2x multiplier before it expires at the end of 2026 Remote, unauthenticated memory corruption reachable during the SMTP conversation, which on a setuid-root binary is a direct path to root on every cPanel host running that release Anything that turns parsed message data into executed code, 20 percent of the record and the class that made Return of the WIZard and 21Nails mass-exploitation events A structural fix to the expansion machinery that closes a family of defects rather than one call site, since the top reward band is for changes that almost certainly prevent major vulnerabilities in the affected code Privilege-separation work that breaks up the single setuid-root design, which permanently downgrades the impact of every future parser bug in the codebase Authentication or relay-control bypass, since Exim's install base is internet-facing shared hosting that patches slowly and stays exploitable long after a fix ships DKIM, SPF or TLS path validation defects, where a crafted signature, policy record or certificate chain makes Exim trust a message or a peer it should not Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report; if we can't reproduce it, it isn't eligible Report to [email protected] and give the maintainers room to ship a fix before any public writeup Upstream has moved: the GitHub repository Google's scope file links, github.com/Exim/exim, is archived, and a patch has to land at code.exim.org to count Configuration errors in somebody else's Exim deployment are not defects in Exim, however widely that configuration is shipped If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for a month. That is a separate pathway with its own one-to-twelve-month age window and a cap of three submissions a month Disclosure Coordinated with the Exim security team at [email protected] . Routing works here: the Patch Rewards rules contain no confidentiality, embargo or third-party clause, only sanctions and territory limits, and the patch money is claimed on a change that is public by the time you claim it. Note that Exim has begun issuing its advisories under GCVE identifiers rather than CVE, so the project's own release notes are where the fix will be announced rather than NVD; hold the detail until that release is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability