Exim and Postfix mail servers: keep them patched

Updated November 2026

Exim and Postfix accept mail from anyone on the internet, so a flaw in either one can be attacked before login. Find out which one you run and where its package comes from. Install the security update, check the configuration, then restart the daemon so the new binary is running.

What they are

Exim and Postfix are mail transfer agents (MTAs). They receive mail over SMTP on port 25 and pass it on to other servers or to local mailboxes. Exim is the default MTA on Debian and is used by cPanel. Postfix is the default on many other Linux systems and is common on Ubuntu, RHEL-family and SUSE servers. A server normally runs one of them, not both.

Both are exposed to every SMTP client on the internet. Upgrades matter more here than for software that sits behind a login. One example is the Exim BDAT flaw CVE-2026-45185, which an attacker can trigger without logging in (details below).

Check the installed version

sudo exim -bV | head -n 1         # Exim (Debian also has exim4 -bV)
sudo exim -bV | grep -iE 'gnutls|openssl'   # which TLS library Exim was built with
postconf mail_version             # Postfix
sudo ss -ltnp | grep ':25 '       # which program listens on port 25

Then ask the package manager which package and repository you have. Distributions backport security fixes into older version numbers, so compare against your distribution's advisory and not only against the upstream version:

# Debian / Ubuntu
apt policy exim4-base exim4-daemon-light exim4-daemon-heavy postfix
# RHEL family, SUSE
rpm -q exim postfix

More methods are on checking installed versions.

Supported upstream versions

As of November 2026, from each project's own pages:

Upstream support, as of November 2026
SoftwareSupportedNot supported
Exim4.100.1 onlyEverything before 4.100.1 ("now obsolete", says exim.org)
Postfix3.8, 3.9, 3.10, 3.11 (latest: 3.11.7, 3.10.14, 3.9.15, 3.8.21)3.7 and older

Exim supports only its newest release. Version 4.100.1 is a security release that fixes four issues, made public in September 2026. One is a heap corruption bug in the Proxy Protocol code that affects Exim 4.83 to 4.100. It only matters if Exim is built and configured to accept connections through a proxy.

Postfix released 3.11.7 and the matching legacy releases on September 7, 2026. They fix problems that "enable remote DOS or SMTP smuggling" (DOS is denial of service). The announcement calls 3.8 to 3.11 the supported versions. It also shipped updates for the out-of-support 3.5 to 3.7, but those do not include two June 2026 patches (large SMTP inputs, TLSA parsing). If you run Postfix 3.7 or older from source, move to a supported branch.

Distro packages are different. Debian, Ubuntu, RHEL and SUSE keep patching the Exim or Postfix version they shipped for the life of that release. A Debian 12 server with Exim 4.96 is fine if the security update is installed. Follow your distribution's advisories. If the OS release itself is end-of-life, see end-of-life servers.

The Exim BDAT flaw (CVE-2026-45185)

Exim's advisory EXIM-Security-2026-05-01.1 rates this use-after-free bug (memory is used after it was freed) critical (CVSS 9.8). It affects Exim 4.97 up to and including 4.99.2, but only builds that use GnuTLS (USE_GNUTLS=yes). The attacker needs only a TLS connection and the CHUNKING (BDAT) SMTP extension. The fix is in 4.99.3, published on May 12, 2026. Exim says "there is no known mitigation other than upgrading."

The grep command above shows whether your Exim uses GnuTLS. The Debian and Ubuntu exim4 packages do. Fixed package versions per distribution are on our page for CVE-2026-45185. Other current flaws are listed under vulnerabilities.

Update commands

Use your distribution's packages unless you have a reason to build from source. Leave out package names that are not installed, or the command stops with an error.

# Debian / Ubuntu
sudo apt update
sudo apt install --only-upgrade exim4-base exim4-daemon-light   # or exim4-daemon-heavy
sudo apt install --only-upgrade postfix

# RHEL, Rocky, AlmaLinux (Exim comes from EPEL)
sudo dnf upgrade --refresh postfix
sudo dnf upgrade --refresh exim

# SUSE / openSUSE
sudo zypper refresh
sudo zypper update postfix      # or: exim

# Alpine
sudo apk update
sudo apk upgrade postfix        # or: exim

# FreeBSD (packages)
sudo pkg update
sudo pkg upgrade postfix        # or: exim

On Debian and Ubuntu, list the Exim packages you have with dpkg -l 'exim4*' and upgrade those. If you build Exim from source, download the release from the exim.org FTP site and check its signature first. Exim 4.100.1 is also tagged in the project's Git repository.

Check the config, then restart

Test the configuration first. If the test fails, fix it before you restart, or mail stops.

# Postfix: check files and permissions, show non-default settings
sudo postfix check
sudo postconf -n | less

# Exim on Debian: rebuild the config from the debconf/split files, then test it
sudo update-exim4.conf
sudo exim4 -bV > /dev/null && echo "config OK"

# Exim elsewhere
sudo exim -bV > /dev/null && echo "config OK"

exim -bV reads the runtime configuration and reports errors in it. Then restart the daemon. These commands restart the mail service. Connections in progress are cut, but senders retry and queued mail stays on disk.

sudo systemctl restart postfix
sudo systemctl restart exim4     # Debian / Ubuntu; the unit is "exim" on RHEL family
# Alpine (OpenRC):  sudo rc-service postfix restart
# FreeBSD:          sudo service postfix restart

postfix reload only re-reads the configuration; it does not replace a running master process with the new binary. After a package update, restart. Package scripts often restart the service for you, but check anyway. An OpenSSL or GnuTLS library update also needs an MTA restart; see restarting after an update.

Verify

Where advisories are published

Quick hardening tips

Sources