Subject: Re: EXIM Security report

From: Federico Kirschbaum <[email-masked]>
Date: Thu, 7 May 2026 11:14:23 -0300

Heiko & Team,

In order to plan a disclosure we would like to know release dates, CVE
number and severity assigned and if you plan some sort of early-notice to
distros.
On our end we are writing a blogpost of this vulnerability, that we intend
to make public after the security release and patches are available.

Best
fede

On Tue, 5 May 2026 at 08:59, Federico Kirschbaum <
[email-masked]> wrote:

> Heiko,
>
> Thanks for your prompt reply. Let us know if you require more information
> from our side on the subject.
>
> Best,
>
> fede
>
> On Tue, 5 May 2026 at 04:53, Heiko Schlittermann <[email-masked]>
> wrote:
>
>> Federico Kirschbaum <[email-masked]> (Mo 04 Mai 2026
>> 22:00:54 CEST):
>> > We were wondering if you and the team had a chance of reviewing our
>> > submission.
>>
>> Yes, it has been reviewed and a fix is in our private repos. We're
>> preparing a security release, which probably will happen during the next
>> about 7 days or so.
>>
>> Currently nothing is published yet, to avoid unnecessary pressure during
>> testing.
>>
>>     Best regards from Dresden/Germany
>>     Viele Grüße aus Dresden
>>     Heiko Schlittermann
>> --
>>  SCHLITTERMANN.de ---------------------------- internet & unix support -
>>  Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} -
>>  gnupg encrypted messages are welcome --------------- key ID: F69376CE -
>>