CVE-2026-55558

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2.

CVSS 3.1

5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-25)

CWE

CWE-74

Published

2026-08-20

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Packages (OSV)

References

• https://github.com/cole/aiosmtplib/commit/9fab7ba1361dbf7622ede1315a24be805cff09c9
• https://github.com/cole/aiosmtplib/releases/tag/v5.1.2
• https://github.com/cole/aiosmtplib/security/advisories/GHSA-vxj7-4xrp-5vr4

Check your stackJSON