{"action":"Upgrade exim4 to 4.98-4 or later.","affected":[{"fixed":"4.98-4","introduced":"0"}],"component":"exim4","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["4.98-4"],"id":"tcs_01M5NN7XEDYD169F7PQC5RR1EB","modified_at":"2026-09-01T20:05:44.922150161Z","published_at":"2025-02-21T13:15:11.687Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2025-26794","https://security-tracker.debian.org/tracker/CVE-2025-26794"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2025-26794","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2025-26794"}],"summary":"Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configu"}