IMAP4 STARTTLS Vulnerability in Python's imaplib
CVE-2026-115559

6.3MEDIUM

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
10 November 2026

What is CVE-2026-115559?

The vulnerability in Python's imaplib affects the STARTTLS command, where unprocessed plaintext bytes may be sent after the handshake, leading to potential command injection. An attacker with network access may exploit this flaw by appending forged responses after the server's acknowledgment, causing clients to interpret these fabricated responses as legitimate data. This could lead to unauthorized command executions over an improperly secured connection, highlighting the critical need for prompt patching and awareness among developers using this library for email communication.

Affected Version(s)

CPython 0 < 3.16.0

References

https://github.com/python/cpython/pull/160370
patch
https://github.com/python/cpython/issues/160369
issue-tracking
https://mail.python.org/archives/list/security-announce@p...
vendor-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

digit50 (https://github.com/digit50)
Jelle Zijlstra (https://github.com/JelleZijlstra)
Hugo van Kemenade (https://github.com/hugovk)
Seth Larson (https://github.com/sethmlarson)
.