Security: CVE-2026-45185 (Dead.Letter)

The vulnerability, tracked as CVE-2026-45185, aka Dead.Letter, has been described as a use-after-free vulnerability in Exim's binary data transmission (BDAT) message body parsing when a TLS connection is handled by GnuTLS.

High 2026-09-08

cPanel

Default Update CMD

sudo /scripts/upcp --force

Situation

The vulnerability, tracked as CVE-2026-45185, aka Dead.Letter, has been described as a use-after-free vulnerability in Exim’s binary data transmission (BDAT) message body parsing when a TLS connection is handled by GnuTLS.

This issue affects Exim: 4.97+

Impact

None on your cPanel server, as we do not explicitly set USE_GNUTLS when building our version of Exim. Our version has a dependency on OpenSSL and not GnuTLS.

Call to Action

None at this time, as cPanel is not affected by this GnuTLS vulnerability.

How to Apply the Fix

Update the affected packages on your server to the patched release, then restart the relevant services.

sudo /scripts/upcp --force

References

Vendor Advisory

Security Advisories

Related Advisories

Security: Privilege Escalation via Phusion Passenger’s Watchdog API

2026-09-08

Security: GCVE-25-2026-07-45-3 Exim .forward Privilege Escalation

2026-09-08

Security: CVE-2026-58048 Database Privilege Escalation

2026-09-08

Check your system for vulnerabilities

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

Check Your System