EUVD-2026-63376
GHSA-vxj7-4xrp-5vr4
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
MITM position required raises AC:H; no auth needed (PR:N); integrity of SMTP session is the sole confirmed impact (I:H, C:N, A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4Blast Radius
ecosystem impact- 757 pypi packages depend on aiosmtplib (157 direct, 604 indirect)
Ecosystem-wide dependent count for version 5.1.2.
DescriptionCVE.org
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2.
AnalysisAI
STARTTLS response injection in aiosmtplib prior to version 5.1.2 allows an active network attacker to desynchronize SMTP command-response pairs by staging plaintext bytes that survive the TLS transport upgrade into the encrypted session. The root cause is that SMTPProtocol.start_tls in protocol.py fails to flush its internal _buffer before calling loop.start_tls, so any attacker-injected SMTP response lines appended after the legitimate 220 reply are subsequently parsed as if they arrived inside the TLS tunnel. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold an active man-in-the-middle network position on the path between the aiosmtplib client and the SMTP server - passive network access is insufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 5.9 (Medium) and vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N accurately reflects a vulnerability that is remotely exploitable without authentication but demands a high-complexity prerequisite: the attacker must occupy an active man-in-the-middle position on the network path between the aiosmtplib client and the SMTP server. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: aiosmtplib 5.1.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today