aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in
    src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without
    clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines
    after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those
    bytes survive the transport upgrade and are parsed as the first response from inside the TLS session,
    desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or
    opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in
    version 5.1.2. (CVE-2026-55558)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in     src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without     clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines     after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those     bytes survive the transport upgrade and are parsed as the first response from inside the TLS session,     desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or     opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in     version 5.1.2. (CVE-2026-55558)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
461053	Echo: aiosmtplib: security update to 5.1.2	Tenable Cloud Security	Echo Local Security Checks	Local	medium
461053	Echo: aiosmtplib: security update to 5.1.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
338711	Linux Distros Unpatched Vulnerability : CVE-2026-55558	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-55558

medium

Tenable Plugins

medium

medium

medium