CVE-2026-55558

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55558", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T23:11:20.213Z", "datePublished": "2026-08-20T14:29:58.580Z", "dateUpdated": "2026-08-20T20:00:21.869Z"}, "containers": {"cna": {"title": "aiosmtplib: STARTTLS response injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-74", "lang": "en", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/cole/aiosmtplib/security/advisories/GHSA-vxj7-4xrp-5vr4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cole/aiosmtplib/security/advisories/GHSA-vxj7-4xrp-5vr4"}, {"name": "https://github.com/cole/aiosmtplib/commit/9fab7ba1361dbf7622ede1315a24be805cff09c9", "tags": ["x_refsource_MISC"], "url": "https://github.com/cole/aiosmtplib/commit/9fab7ba1361dbf7622ede1315a24be805cff09c9"}, {"name": "https://github.com/cole/aiosmtplib/releases/tag/v5.1.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/cole/aiosmtplib/releases/tag/v5.1.2"}], "affected": [{"vendor": "cole", "product": "aiosmtplib", "versions": [{"version": "< 5.1.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T14:29:58.580Z"}, "descriptions": [{"lang": "en", "value": "aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2."}], "source": {"advisory": "GHSA-vxj7-4xrp-5vr4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-20T20:00:16.093023Z", "id": "CVE-2026-55558", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T20:00:21.869Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55558", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T20:00:16.093023Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T20:00:18.930Z"}}], "cna": {"title": "aiosmtplib: STARTTLS response injection", "source": {"advisory": "GHSA-vxj7-4xrp-5vr4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "cole", "product": "aiosmtplib", "versions": [{"status": "affected", "version": "< 5.1.2"}]}], "references": [{"url": "https://github.com/cole/aiosmtplib/security/advisories/GHSA-vxj7-4xrp-5vr4", "name": "https://github.com/cole/aiosmtplib/security/advisories/GHSA-vxj7-4xrp-5vr4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/cole/aiosmtplib/commit/9fab7ba1361dbf7622ede1315a24be805cff09c9", "name": "https://github.com/cole/aiosmtplib/commit/9fab7ba1361dbf7622ede1315a24be805cff09c9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/cole/aiosmtplib/releases/tag/v5.1.2", "name": "https://github.com/cole/aiosmtplib/releases/tag/v5.1.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T14:29:58.580Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55558", "state": "PUBLISHED", "dateUpdated": "2026-08-20T20:00:21.869Z", "dateReserved": "2026-06-16T23:11:20.213Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T14:29:58.580Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "aiosmtplib", "vendor": "cole", "versions": [{"status": "affected", "version": "< 5.1.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2."}, {"lang": "es", "value": "aiosmtplib es un cliente SMTP as\u00edncrono para usar con asyncio. Antes de la versi\u00f3n 5.1.2, SMTPProtocol.start_tls en src/aiosmtplib/protocol.py consume la respuesta 220 del servidor e inicia el handshake TLS sin limpiar SMTPProtocol._buffer. Un atacante de red activo puede colocar l\u00edneas de respuesta SMTP elegidas por el atacante despu\u00e9s de la respuesta 220 en texto plano en el mismo segmento de red. El m\u00e9todo luego llama a loop.start_tls; esos bytes sobreviven a la actualizaci\u00f3n del transporte y se analizan como la primera respuesta desde dentro de la sesi\u00f3n TLS, desincronizando los pares de comando y respuesta SMTP subsiguientes. Las conexiones que usan start_tls=True o STARTTLS oportunista se ven afectadas, mientras que las conexiones que usan use_tls=True no lo est\u00e1n. Este problema se soluciona en la versi\u00f3n 5.1.2."}], "id": "CVE-2026-55558", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55558", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T20:00:16.093023Z", "version": "2.0.3"}}]}, "published": "2026-08-20T15:17:31.980", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/cole/aiosmtplib/commit/9fab7ba1361dbf7622ede1315a24be805cff09c9"}, {"source": "security-advisories@github.com", "url": "https://github.com/cole/aiosmtplib/releases/tag/v5.1.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/cole/aiosmtplib/security/advisories/GHSA-vxj7-4xrp-5vr4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.1.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "aiosmtplib", "source": "cna", "vendor": "cole"}, "product": "aiosmtplib", "vendor": "cole"}], "created": "2026-08-20T22:15:04.091760+00:00", "updated": "2026-08-21T12:09:19.472668+00:00", "vendors": ["cole", "cole$PRODUCT$aiosmtplib"]}