CVE-2026-55558

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2.

• CWE-74

• https://github.com/cole/aiosmtplib/commit/9fab7ba1361dbf7622ede1315a24be805cff09c9
• https://github.com/cole/aiosmtplib/releases/tag/v5.1.2
• https://github.com/cole/aiosmtplib/security/advisories/GHSA-vxj7-4xrp-5vr4

Published

Aug 20, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55552Yamcs is a mission control framework. Prior to 5.11.13, Yamc…7.5
• CVE-2026-55553urllib is an HTTP client for Node.js that supports authentic…7.5
• CVE-2026-55554Dompdf is an HTML to PDF converter for PHP. In versions 3.15…7.5
• CVE-2026-55555Dompdf is an HTML to PDF converter for PHP. Versions 3.15 an…7.5
• CVE-2026-55556Rsyslog is a rocket-fast system for log processing. From 8.2…8.2
• CVE-2026-55557browse-mcp is a Playwright-based headless-browser MCP server…8.6
• CVE-2026-55559Yamcs is a mission control framework. Prior to 5.12.8 and 5.…9.8
• CVE-2026-5556A security vulnerability has been detected in badlogic pi-mo…6.3
• CVE-2026-55563Feast is the open source feature store for AI and machine le…8.9
• CVE-2026-55564FreeRDP is a free implementation of the Remote Desktop Proto…7.1
• CVE-2026-55565Yamcs is a mission control framework. Prior to 5.12.8 and 5.…9.9
• CVE-2026-55566Yamcs is a mission control framework. Prior to 5.12.8 and 5.…4.3