Aiosmtplib
Monthly
STARTTLS response injection in aiosmtplib prior to version 5.1.2 allows an active network attacker to desynchronize SMTP command-response pairs by staging plaintext bytes that survive the TLS transport upgrade into the encrypted session. The root cause is that SMTPProtocol.start_tls in protocol.py fails to flush its internal _buffer before calling loop.start_tls, so any attacker-injected SMTP response lines appended after the legitimate 220 reply are subsequently parsed as if they arrived inside the TLS tunnel. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the CVSS AC:H rating confirms exploitation requires an active man-in-the-middle network position.
STARTTLS response injection in aiosmtplib prior to version 5.1.2 allows an active network attacker to desynchronize SMTP command-response pairs by staging plaintext bytes that survive the TLS transport upgrade into the encrypted session. The root cause is that SMTPProtocol.start_tls in protocol.py fails to flush its internal _buffer before calling loop.start_tls, so any attacker-injected SMTP response lines appended after the legitimate 220 reply are subsequently parsed as if they arrived inside the TLS tunnel. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the CVSS AC:H rating confirms exploitation requires an active man-in-the-middle network position.