Exim Releases the First Release Candidate for Version 4.100
Exim 4.100-RC1 has hit the testing directory, and if you're running the internet's oldest continuously maintained mail transfer agent, you'll want to look closer. The current stable release remains 4.99.5. The RC1 tarball signals what comes next.
Philip Hazel's Cambridge-developed MTA has been adding features at a breakneck pace throughout the 4.x line. The 4.99 release introduced loadable modules and transactional hints databases. Crossing 4.100 simply acknowledges that the codebase has grown well past its original shape. The number ticks up, but the core engine is the same Exim operators have been tuning for years.
What's New in 4.100
The headline changes cluster around email authentication and extensibility.
Native support for SPF, DKIM, DMARC, and ARC is now the default path. Operators can build Exim with EXPERIMENTAL_DMARC_NATIVE to use the fully integrated implementation rather than shelling out to external libraries. The experimental flags that clung to these features for years are gone.
Lookup capabilities got a refresh. New psl and regdom lookups help operators match against the Public Suffix List and resolve registered domains for anti-phishing and DMARC policy checks. JSON parsing is now available directly in lookup chains, with expansion conditions like forall_json and any_json.
Loadable modules are now first-class citizens. You can list installed modules with exim -bI:modules and build lookups, authenticators, routers, and transports as dynamic libraries. The -bI:modules flag appears in the build output, which makes auditing your deployment significantly easier.
Performance tweaks target modern hardware. remote_max_parallel jumps from 4 to 6, reflecting the reality of multi-core servers and reducing connection pooling pressure during high load. Privilege management got a rework too. Exim now retains elevated permissions only while a chained message or response is pending, eliminating the deferral warnings that used to pop up when the daemon dropped privs before sending bounces.
Security Hardening and CVEs
4.100-RC1 closes four confirmed vulnerabilities, building on the hardening work that defined the 4.99.x release cycle.
The CVE list includes a medium-severity issue where crafted DNS records can crash the Exim process when running under musl libc. glibc builds are unaffected, but if you're compiling against musl, this one matters.
JSON string expansions can corrupt the heap with crafted source strings, risking out-of-bounds reads. The ${from_utf8:} expansion operator reads into the heap on malformed input, and if you use it in SMTP rejection messages, data exfiltration is possible. Finally, the SPA authenticator uses an uninitialized buffer, allowing potential data leaks via client-supplied data.
Beyond the CVEs, the changelog details a broad set of hardening patches. ARC processing no longer segfaults on non-decodable public keys. The eval expansion operator now refuses tainted arguments. Pipe transport output gets safely truncated. Rspamd external calls are properly quoted.
The context for this hardening dates back to November 2025, when NIST researcher Andrew Fasano disclosed SQL injection and heap overflow flaws in the SQLite hints database. That disclosure forced rapid patches through 4.99.1 and beyond. Exim 4.100 responds with expanded taint tracking that now covers certextract expansions and DBM lookups, addressing the provenance gaps exposed by the SQLite incidents.
Breaking Changes and Removals
Long-deprecated options finally hit the cutting room floor.
The drop_cr config option, obsolete since version 4.21, now triggers a hard error. Brightmail malware scanner support is gone. Interbase database driver is removed. The pwcheck expansion condition is deprecated in favor of saslauthd.
Exim can no longer read spoolfiles from pre-4.50 versions. If your queue dates back to the early 2000s, you'll need to migrate before upgrading. Log output format changes too. Numeric error codes in log lines are stripped, so any scripts parsing those patterns need updating.
The Bottom Line
Exim 4.100 is the culmination of two decades of incremental development. The shift to native authentication, dynamic modules, and expanded taint tracking brings the Cambridge-developed MTA closer to the feature parity many operators have been waiting for.
It's also a reminder that legacy C codebases accumulate subtle vulnerabilities over time. The musl-specific DNS crash and the JSON heap corruption show that even well-tested code requires constant scrutiny as the threat landscape evolves.
For operators, the upgrade path is clear but requires care. Review your configuration against the removals. Check module dependencies. If you're on musl, the CVE-2026-40684 fix is non-negotiable.
The RC is available now. Head here to the official Exim testing directory for the tarball. The stable release will follow once the test period concludes.
