Log in Start free

Vulnerability · Published Aug 20, 2026 · Assigned by GitHub_M

CVE-2026-55558aiosmtplib: STARTTLS response injection

Medium 5.9

In plain English

A medium-severity injection in aiosmtplib from cole. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.4%top 65.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12aiosmtplibno fix listedDEBIAN-CVE-2026-55558
Debian:13aiosmtplibno fix listedDEBIAN-CVE-2026-55558
Debian:14aiosmtplib5.1.2-1DEBIAN-CVE-2026-55558
PyPIaiosmtplib5.1.2PYSEC-2026-3805
PyPIaiosmtplib5.1.2GHSA-vxj7-4xrp-5vr4
Ubuntu:22.04:LTSaiosmtplibno fix listedUBUNTU-CVE-2026-55558
Ubuntu:26.04:LTSaiosmtplibno fix listedUBUNTU-CVE-2026-55558
Ubuntu:26.10aiosmtplibno fix listedUBUNTU-CVE-2026-55558

Affected products (as reported)

VendorProductVersions
cole aiosmtplib < 5.1.2

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References