CVE-2026-55558: aiosmtplib: STARTTLS response injection
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.starttls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using starttls=True or opportunistic STARTTLS are affected, while connections using usetls=True are not. This issue is fixed in version 5.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aiosmtplibto a version that resolves this vulnerability.Fixed in 5.1.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
aiosmtplib versions before 5.1.2 are affected when they use start_tls=True or opportunistic STARTTLS. Connections configured with use_tls=True are not affected.
What does an attacker need to exploit it?
An attacker must be active on the network path or same network segment and be able to inject chosen SMTP response lines immediately after the server's plaintext 220 STARTTLS response. No application privileges or user interaction are required.
What is the impact of successful exploitation?
Injected response bytes can remain buffered through the TLS transport upgrade and be treated as the first response within the TLS session. This desynchronizes later SMTP commands and responses and can compromise integrity.
What should teams do if they cannot immediately upgrade?
Use use_tls=True rather than start_tls=True or opportunistic STARTTLS where the SMTP service supports it. Upgrade to aiosmtplib 5.1.2 when possible.