CVE-2026-55558

aiosmtplib: STARTTLS response injection

Workarounds

If you cannot upgrade immediately:

• Use implicit TLS instead of STARTTLS. Connect with use_tls=True. This removes the plaintext phase entirely.
• If STARTTLS is unavoidable, restrict connections to servers reached over a trusted network path.

When a connection is upgraded with STARTTLS, aiosmtplib reads the server's 220 go-ahead reply and immediately performs the TLS handshake without discarding any data still sitting in the receive buffer. Bytes the protocol read off the plaintext socket before the handshake survive across the plaintext→TLS boundary (the asyncio transport is swapped in place, so the protocol object and its buffer are reused), and are then parsed as though they had arrived inside the TLS session.

Who is affected: Any caller that uses STARTTLS by passing start_tls=True or start_tls=None when the server advertises STARTTLS, and whose traffic can be intercepted by an active network attacker on the plaintext leg of the connection.

A man in the middle can send, in a single segment immediately after the client's STARTTLS command, the 220 reply followed by attacker-chosen response lines (e.g. 220 Go ahead\r\n250-mx.evil\r\n250 AUTH LOGIN\r\n). aiosmtplib
consumes only the 220, leaves the injected lines buffered, completes the handshake, and then parses the attacker's pre-staged plaintext as the first post-TLS server response. This also desynchronizes every
subsequent command/response pair inside the "encrypted" session.

Not affected: Connections using implicit/direct TLS (use_tls=True) have no plaintext phase and are not vulnerable. The attack requires an active man in the middle via network compromise; a passive eavesdropper cannot exploit it.

CVE-2026-55558 has a CVSS score of 5.9 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (5.1.2); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

A fix is available in aiosmtplib 5.1.2. All earlier versions that support STARTTLS are affected; upgrade to 5.1.2 or
later.

The fix treats any data buffered after the 220 STARTTLS reply and before the handshake as a protocol violation, per RFC 3207 §4.2 ("the client MUST discard any knowledge obtained from the server … which was not
obtained from the TLS negotiation itself").

1. What is CVE-2026-55558? CVE-2026-55558 is a medium-severity security vulnerability in aiosmtplib (pip), affecting versions <= 5.1.1. It is fixed in 5.1.2.
2. How severe is CVE-2026-55558? CVE-2026-55558 has a CVSS score of 5.9 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of aiosmtplib are affected by CVE-2026-55558? aiosmtplib (pip) versions <= 5.1.1 is affected.
4. Is there a fix for CVE-2026-55558? Yes. CVE-2026-55558 is fixed in 5.1.2. Upgrade to this version or later.
5. Is CVE-2026-55558 exploitable, and should I be worried? Whether CVE-2026-55558 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-55558 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-55558? Upgrade aiosmtplib to 5.1.2 or later.