Description

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-20T15:17:31.980Z",
  "pubdate": "2026-08-20T15:17:31.980Z",
  "executiveSummary": "A buffer desynchronization vulnerability exists in the aiosmtplib asynchronous SMTP client prior to version 5.1.2. The vulnerability resides in the SMTPProtocol.start_tls function located within src/aiosmtplib/protocol.py, which fails to clear the internal SMTPProtocol._buffer after consuming the server's initial 220 greeting response and prior to initiating the TLS handshake.\nThis flaw allows an active network attacker positioned on the same network segment to inject arbitrary, attacker-chosen SMTP response lines immediately following the plaintext 220 response.\nWhen loop.start_tls is subsequently invoked, the residual bytes in the buffer survive the transport layer security upgrade and are erroneously parsed as legitimate responses from within the newly established TLS session. This causes command and response pair desynchronization between the client and server.\nConnections utilizing explicit start_tls=True or opportunistic STARTTLS mechanisms are affected, whereas connections established with use_tls=True remain unaffected.\nThe risk implication involves potential command injection, session manipulation, or protocol degradation attacks facilitated by a network-positioned attacker capable of intercepting and manipulating plaintext traffic prior to the cryptographic boundary establishment.",
  "technicalDetails": "The vulnerability is caused by improper state and buffer management during the transition from plaintext communication to encrypted TLS sessions in aiosmtplib.\nThe vulnerable component is SMTPProtocol.start_tls in src/aiosmtplib/protocol.py, affecting versions prior to 5.1.2.\nAffected configurations include connections using start_tls=True or opportunistic STARTTLS, while use_tls=True connections are not impacted as they establish TLS immediately without a plaintext phase.\nExploitation requires an active network attacker positioned within the same network segment capable of performing adversary-in-the-middle (MitM) network manipulation.\nAuthentication and privilege requirements for the attacker are minimal regarding the application itself, as the attack targets the network transport layer during the initial connection handshake.\nThe attack flow proceeds as follows: First, the aiosmtplib client initiates a TCP connection to the target SMTP server. Second, the server responds with a plaintext 220 greeting. Third, an active network attacker intercepts or injects malicious SMTP response lines immediately following the plaintext 220 response within the same network segment.\nFourth, the client's SMTPProtocol.start_tls method consumes the 220 response but fails to clear the internal SMTPProtocol._buffer, leaving the injected response bytes resident in memory.\nFifth, the method calls loop.start_tls to upgrade the transport layer to TLS.\nSixth, because the internal buffer is not purged, the leftover injected bytes survive the transport upgrade and are pushed into the TLS session.\nSeventh, the client parses these injected bytes as the initial response coming from inside the encrypted TLS session, resulting in severe desynchronization of subsequent SMTP command and response pairs.\nPost-exploitation impact includes the potential desynchronization of protocol states, allowing an attacker to manipulate command flows, inject unauthorized commands, or bypass security logic dependent on predictable SMTP transaction sequencing."
}