CVE-2026-55558: Cole Aiosmtplib

Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days.

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2.

Affected products

• Cole Aiosmtplib: before 5.1.2 (fixed in 5.1.2)

Published 2026-08-20. Last modified 2026-09-18.