CVE-2026-55558aiosmtplib: STARTTLS response injection
Updated under an hour ago ()
Does this affect you?
It affects cole aiosmtplib. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2.
- CVSS
- 5.9 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness (CWE)
- CWE-74
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- Aug 20, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
cole aiosmtplib cole:aiosmtplib (from the name) | before 5.1.2 | CNA record |
References
- https://github.com/cole/aiosmtplib/security/advisories/GHSA-vxj7-4xrp-5vr4x-refsource-confirm
- https://github.com/cole/aiosmtplib/commit/9fab7ba1361dbf7622ede1315a24be805cff09c9x-refsource-misc
- https://github.com/cole/aiosmtplib/releases/tag/v5.1.2x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.