SMTP Protocol Vulnerability in aiosmtplib by Cole

CVE-2026-55558

What is CVE-2026-55558?

The aiosmtplib library, an asynchronous SMTP client, is susceptible to a vulnerability where the SMTPProtocol.start_tls method improperly handles the server's initial 220 response. This flaw allows an active attacker on the same network segment to inject precise SMTP responses that disrupt the expected sequence of commands and responses during the TLS handshaking process. Specifically, when using start_tls=True or opportunistic STARTTLS, these injected responses can be misinterpreted within a secure TLS session, leading to potential manipulation of email communication. The vulnerability has been addressed in version 5.1.2 of aiosmtplib.

References