CVE-2021-38370: Alpine Project Alpine

Medium severity, CVSS 5.9. EPSS: 1.6% chance of exploitation in the next 30 days.

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.

Affected products

• Alpine Project Alpine: before 2.25 (fixed in 2.25)

Published 2021-08-10. Last modified 2026-06-17.