CVE-2024-27305

aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-345
• CWE-345

• https://github.com/aio-libs/aiosmtpd/commit/24b6c79c8921cf1800e27ca144f4f37023982bbbPatch
• https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-pr2m-px7j-xg65Vendor Advisory
• https://www.postfix.org/smtp-smuggling.htmlProduct
• https://github.com/aio-libs/aiosmtpd/commit/24b6c79c8921cf1800e27ca144f4f37023982bbbPatch
• https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-pr2m-px7j-xg65Vendor Advisory
• https://www.postfix.org/smtp-smuggling.htmlProduct

Published

Mar 12, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2730Mautic uses predictable page indices for unpublished landing…5.3
• CVE-2024-27300phpMyFAQ is an open source FAQ web application for PHP 8.1+ …5.4
• CVE-2024-27301Support App is an opensource application specialized in mana…7.3
• CVE-2024-27302go-zero is a web and rpc framework. Go-zero allows user to s…9.1
• CVE-2024-27303electron-builder is a solution to package and build a ready …7.3
• CVE-2024-27304pgx is a PostgreSQL driver and toolkit for Go. SQL injection…9.8
• CVE-2024-27306aiohttp is an asynchronous HTTP client/server framework for …6.1
• CVE-2024-27307JSONata is a JSON query and transformation language. Startin…9.8
• CVE-2024-27308Mio is a Metal I/O library for Rust. When using named pipes …9.1
• CVE-2024-27309While an Apache Kafka cluster is being migrated from ZooKeep…7.4
• CVE-2024-2731Users with low privileges (all permissions deselected in the…5.4
• CVE-2024-27310Zoho ManageEngine ADSelfService Plus versions below 6401 are…6.5