CVE-2026-55558: CVE-2026-55558: STARTTLS Response Injection in aiosmtplib

#security #cve #cybersecurity

CVE-2026-55558: STARTTLS Response Injection in aiosmtplib

Vulnerability ID: CVE-2026-55558
CVSS Score: 5.9
Published: 2026-08-27

An input buffering vulnerability exists in the aiosmtplib asynchronous SMTP client library before version 5.1.2. When upgrading a plaintext connection to TLS via STARTTLS, the library processes buffered plaintext responses after transport negotiation has completed. This behavior allows a network-positioned attacker to inject spoofed server responses prior to negotiation, leading to command/response desynchronization, arbitrary capability injection, and potential credential theft.

TL;DR

aiosmtplib does not clear its internal read buffer prior to executing a TLS handshake during STARTTLS negotiation. An attacker positioned on the network path can pipeline malicious plaintext responses that survive the transport upgrade, hijacking subsequent encrypted commands.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-74
Attack Vector: Network
CVSS v3.1 Score: 5.9 (Medium)
EPSS Score: 0.00261
Impact: Integrity Loss / Session Desynchronization
Exploit Status: Proof of Concept (PoC) documented in patch unit tests
KEV Status: Not listed in CISA KEV

Affected Systems

Python asynchronous applications utilizing aiosmtplib for SMTP transport
aiosmtplib: < 5.1.2 (Fixed in: 5.1.2)

Code Analysis

Commit: 9fab7ba

STARTTLS injection defense (RFC 3207 section 4.2)

@@ -379,6 +379,13 @@ async def start_tls(
             if self.transport is None or self.transport.is_closing():
                 raise SMTPServerDisconnected("Connection lost")

+            # STARTTLS injection defense (RFC 3207 section 4.2): a compliant
+            # server sends nothing after its 220 reply until TLS is negotiated.
+            # Any bytes still buffered here are plaintext a MITM may have
+            # injected; discard them so they cannot be misread as part of the
+            # encrypted session once the handshake completes.
+            del self._buffer[:]
+
             try:
                 tls_transport = await self._loop.start_tls(
                     cast(asyncio.WriteTransport, self.transport),

Mitigation Strategies

Upgrade aiosmtplib to version 5.1.2 or later.
Reconfigure SMTP clients to use Implicit TLS (use_tls=True) on port 465 to bypass plaintext negotiation entirely.
Implement DNSSEC to prevent DNS-based Adversary-in-the-Middle hijacking of SMTP servers.

Remediation Steps:

Identify all deployment instances using the aiosmtplib library.
Update requirements.txt, Pipfile, or pyproject.toml to define aiosmtplib >= 5.1.2.
Execute dependency installation pipeline (e.g., pip install --upgrade aiosmtplib).
Validate connection configurations and verify fallback behaviors are disabled.

References

Read the full report for CVE-2026-55558 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community