CVE-2026-55558

Name of the Vulnerable Software and Affected Versions aiosmtplib versions prior to 5.1.2

Description The SMTPProtocol.start tls() function in src/aiosmtplib/protocol.py fails to clear the SMTPProtocol. buffer after consuming the server's 220 response and initiating the TLS handshake. A network attacker can inject malicious SMTP response lines following the plaintext 220 response. These bytes persist through the transport upgrade and are incorrectly parsed as the initial response within the TLS session, leading to the desynchronization of subsequent SMTP command and response pairs. This issue affects connections utilizing start tls=True or opportunistic STARTTLS, but does not impact connections using use tls=True.

Recommendations Update to version 5.1.2.