CVE-2021-38371: Exim

High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days.

The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending.

Affected products

• Exim Exim: up to and including 4.94.2

Published 2021-08-10. Last modified 2026-06-17.