Medium
Security advisory
Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-39929
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 19:38 UTC · Revision 1
Source evidence
Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.
osv:CVE-2024-39929
Complete source record
{
"id": "1ac720f1b50c14963ea5141bbe93c52e1a76763173aa82fb35a4c6e176b33244",
"url": "https://osv.dev/vulnerability/CVE-2024-39929",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2024-39929",
"summary": "Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.",
"evidence": "osv:CVE-2024-39929",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2024-39929",
"aliases": [
"CVE-2024-39929"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/exim/exim",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "5a8fc079931410b30889e69f890857b05ca8d4b2"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "4.97.1"
}
],
"source": "DESCRIPTION"
},
{
"cpe": "cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "4.97.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"exim-4.97.1",
"exim-4.97",
"exim-4.97-RC2",
"exim-4.96",
"exim-4.97-RC1",
"exim-4.97-RC0",
"exim-4.95",
"exim-4.96-RC2",
"exim-4.96-RC1",
"exim-4.96-RC0",
"exim-4.95-RC2",
"exim-4.95-RC1",
"exim-4.95-RC0",
"exim-4.94",
"exim-4.94-RC2",
"exim-4.94-RC1",
"exim-4_94_RC0",
"exim-4.93",
"exim-4.93-RC7",
"exim-4.93-RC6",
"exim-4.93-RC5",
"exim-4.93-RC4",
"exim-4.93-RC3",
"exim-4.93-RC2",
"exim-4.93-RC1",
"exim-4.93-RC0",
"exim-4.92-jgh",
"exim-4.92-RC6",
"exim-4.92",
"exim-4.92-RC5",
"exim-4.92-RC4",
"exim-4.92-RC3",
"exim-4.92-RC2",
"exim-4.92-RC1",
"exim-4_91",
"exim-4_91_RC4",
"exim-4_91_RC3",
"exim-4_91_RC2",
"exim-4_91_RC1",
"exim-4_90_RC4",
"exim-4_90",
"exim-4_90_RC3",
"exim-4_90_RC2",
"exim-4_90_RC1",
"exim-4.90devstart",
"exim-4_89_RC3",
"exim-4_89_RC1",
"exim-4_88",
"exim-4_87",
"exim-4_88_RC6",
"exim-4_88_RC5",
"exim-4_88_RC4",
"exim-4_88_RC3",
"exim-4_88_RC2",
"exim-4_88_RC1",
"exim-4_87_RC7",
"exim-4_87_RC6",
"exim-4_87_RC5",
"exim-4_87_RC4",
"exim-4_84",
"exim-4_86",
"exim-4_85",
"exim-4_87_RC3",
"exim-4_87_RC2",
"exim-4_87_RC1",
"exim-4_86_RC5",
"exim-4_86_RC4",
"exim-4_86_RC3",
"exim-4_86_RC2",
"exim-4_86_RC1",
"exim-4_85_RC4",
"exim-4_85_RC3",
"exim-4_85_RC2",
"exim-4_85_RC1",
"exim-4_84_RC2",
"exim-4_84_RC1",
"exim-4_83",
"exim-4_83_RC3",
"exim-4_83_RC2",
"exim-4_83_RC1",
"exim-4_82",
"exim-4_82_RC5",
"exim-4_82_RC4",
"exim-4_82_RC3",
"exim-4_82_RC2",
"exim-4_82_RC1",
"exim-4_80",
"exim-4_80_RC7",
"exim-4_80_RC6",
"exim-4_80_RC5",
"exim-4_80_RC4",
"exim-4_80_RC3",
"exim-4_80_RC2",
"exim-4_80_RC1",
"exim-4_77",
"exim-4_77_RC4",
"exim-4_77_RC3",
"exim-4_77_RC2",
"exim-4_77_RC1",
"exim-4_76",
"exim-4_76_RC2",
"exim-4_76_RC1",
"exim-4_75",
"exim-4_75_RC3",
"exim-4_75_RC2",
"exim-4_75_RC1",
"exim-4_74",
"exim-4_74_RC1",
"exim-4_73",
"exim-4_73_RC1",
"exim-4_73_RC00",
"exim-4_72",
"exim-4_72_RC2",
"exim-4_72_RC1",
"exim-4_71",
"exim-4_70",
"exim-4_70_RC4",
"exim-4_70_RC3",
"DEVEL_PDKIM_START",
"exim-4_69",
"exim-4_68",
"exim-4_67",
"exim-4_66",
"exim-4_65",
"exim-4_64",
"exim-4_63",
"exim-4_62",
"exim-4_61",
"exim-4_54",
"exim-4_53",
"exim-4_52",
"exim-4_51",
"exim-4_50"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-39929.json"
}
}
],
"modified": "2026-10-28T02:30:51.845110506Z",
"provider": "osv",
"references": [
"https://bugs.exim.org/show_bug.cgi?id=3099#c4",
"https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b",
"https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357",
"https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3",
"https://www.rfc-editor.org/rfc/rfc2231.txt",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39929.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-39929"
],
"provider_metadata": {
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39929.json"
}
},
"related_cves": [
{
"value": "CVE-2024-39929",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 520242,
"published_at": "2024-07-04T00:00:00+00:00"
}