CVE-2026-55558
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2.
Risk Assessment
The vulnerability allows a man-in-the-middle attacker to manipulate the SMTP session, which may lead to interception or modification of email messages. This can compromise confidentiality and integrity of communication.
Recommendation
It is recommended to immediately update the aiosmtplib library to version 5.1.2 or later. Also consider using connections with use_tls=True, which are not vulnerable.
Other vulnerabilities in aiosmtplib
See all- CVE-2026-90467Medium
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.
- CVE-2026-53533Medium
aiosmtplib before 5.1.1 does not reject addresses containing CR or LF bytes in SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn(). Data after the line break is framed as additional standalone SMTP command lines, allowing an attacker to inject commands such as MAIL FROM, RCPT TO, RSET, DATA, or AUTH. SMTP.sendmail() and SMTP.send() without a Message object pass addresses through the affected methods, while SMTP.send_message() is not affected. Successful injection can desynchronize the command-response pipeline, hang the SMTP instance, or send an arbitrary message without requiring attacker control of the SMTP server.
Original NVD description (English source)
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS