Live › vulnerability › CVE-2019-10149
Go to dashboardExim, a mail transfer agent that runs on many mail servers, does not properly validate recipient addresses in its delivery code. A remote attacker can send a crafted address to run commands on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Exim Mail Transfer Agent (MTA) | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Apply the Exim update that addresses CVE-2019-10149 per vendor instructions (CISA KEV required action); the fixed version is not stated in the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2019-10149")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.