cole aiosmtplib up to 5.1.1 protocol.py SMTPProtocol.start_tls missing encryption

Summaryinfo

A vulnerability was found in cole aiosmtplib up to 5.1.1. It has been declared as problematic. Affected by this vulnerability is the function SMTPProtocol.start_tls of the file src/aiosmtplib/protocol.py. The manipulation results in missing encryption. This vulnerability is identified as CVE-2026-55558. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in cole aiosmtplib up to 5.1.1. It has been classified as problematic. Affected is the function SMTPProtocol.start_tls of the file src/aiosmtplib/protocol.py. The manipulation with an unknown input leads to a missing encryption vulnerability. CWE is classifying the issue as CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. This is going to have an impact on confidentiality. CVE summarizes:

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-55558 since 06/17/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1600.

Upgrading to version 5.1.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• cole

Name

• aiosmtplib

Version

• 5.1.0
• 5.1.1

Website

• Product: https://github.com/cole/aiosmtplib/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion