CVE-2026-53533

Name of the Vulnerable Software and Affected Versions aiosmtplib versions prior to 5.1.1

Description The software fails to reject embedded carriage return and line feed (CRLF) bytes in email addresses. When a caller-supplied address containing these bytes is passed to the SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), or SMTP.expn() functions, the bytes are written verbatim to the SMTP control connection. This allows an attacker to perform SMTP command injection by smuggling arbitrary SMTP verbs such as MAIL FROM, RCPT TO, RSET, DATA, or AUTH into the session. The SMTP.sendmail() function is also affected as it passes addresses verbatim to SMTP.mail() and SMTP.rcpt(). This can lead to a denial of service by desynchronizing the command/response pipeline, causing the client to hang, or allow the sending of arbitrary messages.

Recommendations Update to version 5.1.1 or later. As a temporary workaround, restrict or sanitize any user-influenced data passed to the SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), SMTP.expn(), and SMTP.sendmail() functions to ensure no CRLF characters are present.