p PatchFirst

CVE-2026-55558

CVE-2026-55558 · aiosmtplib: STARTTLS response injection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2.

CVSS 5.9 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • aiosmtplib

    Versions
    • < 5.1.2: Affected

    No fix published

  • aiosmtplib Debian:12

    Versions
    • 2.0.0-1
    • 3.0.1-1
    • 3.0.2-1
    • 3.0.2-2
    • 4.0.0-1
    • 4.0.1-1
    • 4.0.1-1~exp1
    • 4.0.2-1
    • 5.0.0-1
    • 5.1.0-1
    • 5.1.0-2
    • 5.1.0-3
    • 5.1.2-1
    • 5.1.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • aiosmtplib Debian:13

    Versions
    • 4.0.0-1
    • 4.0.1-1
    • 4.0.1-1~exp1
    • 4.0.2-1
    • 5.0.0-1
    • 5.1.0-1
    • 5.1.0-2
    • 5.1.0-3
    • 5.1.2-1
    • 5.1.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • aiosmtplib Debian:14

    Versions
    • 4.0.0-1
    • 4.0.1-1
    • 4.0.1-1~exp1
    • 4.0.2-1
    • 5.0.0-1
    • 5.1.0-1
    • 5.1.0-2
    • 5.1.0-3
    Affected ranges
    • ECOSYSTEM: < 5.1.2-1

    Update to 5.1.2-1

  • aiosmtplib PyPI

    Versions
    • 0.1
    • 0.1.2
    • 0.1.3
    • 0.1.4
    • 0.1.5rc2
    • 0.1.6
    • 0.1.7
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 1.0.3
    • 1.0.4
    • 1.0.5
    • 1.0.6
    • 1.1.0
    • 1.1.1
    • 1.1.2
    • 1.1.3
    • 1.1.4
    • 1.1.5
    • 1.1.6
    • 1.1.7
    • 1.1b0
    • 2.0.0
    • 2.0.0b0
    • 2.0.0b1
    • 2.0.1
    • 2.0.2
    • 3.0.0
    • 3.0.1
    • 3.0.2
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 5.0.0
    • 5.1.0
    • 5.1.1
    Affected ranges
    • ECOSYSTEM: < 5.1.2

    Update to 5.1.2

  • aiosmtplib Ubuntu:22.04:LTS

    Versions
    • 1.1.4-1
    • 1.1.4-2
    • 1.1.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • aiosmtplib Ubuntu:26.10

    Versions
    • 5.1.0-1
    • 5.1.0-3
    • 5.1.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • aiosmtplib Ubuntu:26.04:LTS

    Versions
    • 4.0.0-1
    • 4.0.2-1
    • 5.0.0-1
    • 5.1.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →