{"items":[{"id":"NVI-00013838","kind":"vulnerability","title":"aiosmtplib: STARTTLS response injection","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-vxj7-4xrp-5vr4","CVE-2026-55558"],"plain_summary":"GitHub lists this reviewed advisory for aiosmtplib. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-01b551173c5da7d899aaee92701421e1"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-27T23:32:23.000Z","value":"5.9 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-0e1c228172f35e5a34f1c825ac6ea1e3"},{"kind":"EPSS","as_of":"2026-11-05T12:03:04.000Z","value":"0.403%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.34716. Missing scores are unknown.","source_id":"sr-01b551173c5da7d899aaee92701421e1"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0e1c228172f35e5a34f1c825ac6ea1e3","url":"https://github.com/advisories/GHSA-vxj7-4xrp-5vr4","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-vxj7-4xrp-5vr4","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T09:56:23.004Z"},{"id":"sr-01b551173c5da7d899aaee92701421e1","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-55558","publisher":"FIRST EPSS","observed_at":"2026-11-06T07:17:46.387Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0e1c228172f35e5a34f1c825ac6ea1e3"],"technology":"aiosmtplib","known_exclusions":[],"conditions_summary":"## Impact\n\nWhen a connection is upgraded with STARTTLS, aiosmtplib reads the server's 220 go-ahead reply and immediately performs the TLS handshake without discarding any data still sitting in the receive buffer. Bytes the protocol read off the plaintext socket before the handshake survive across the plaintext→TLS boundary (the asyncio transport is swapped in place, so the protocol object and its buffer are reused), and are then parsed as though they had arrived inside the TLS session.\n\nWho is affected: Any caller that uses STARTTLS by passing `start_tls=True` or `start_tls=None` when the server advertises STARTTLS, and whose traffic can be intercepted by an active network attacker on the plaintext leg of the connection.\n\nA man in the middle can send, in a single segment immediately after the client's STARTTLS command, the 220 reply followed by attacker-chosen response lines (e.g. 220 Go ahead\\r\\n250-mx.evil\\r\\n250 AUTH LOGIN\\r\\n). aiosmtplib\n  consumes only the 220, leaves the injected lines buffered, completes the handshake, and then parses the attacker's pre-staged plaintext as the first post-TLS server response. This also desynchronizes every\n  subsequent command/response pair ","public_affected_ranges":["<= 5.1.1"]}],"null_published_at":"2026-11-07T07:07:42.517Z","source_updated_at":"2026-08-27T23:32:23.000Z","source_disclosed_at":"2026-08-27T23:32:22.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-02T09:56:23.004Z"},{"id":"NVI-00013838","kind":"vulnerability","title":"aiosmtplib: STARTTLS response injection","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-vxj7-4xrp-5vr4","CVE-2026-55558"],"plain_summary":"GitHub lists this reviewed advisory for aiosmtplib. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0e1c228172f35e5a34f1c825ac6ea1e3"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-27T23:32:23.000Z","value":"5.9 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-0e1c228172f35e5a34f1c825ac6ea1e3"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0e1c228172f35e5a34f1c825ac6ea1e3","url":"https://github.com/advisories/GHSA-vxj7-4xrp-5vr4","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-vxj7-4xrp-5vr4","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T09:56:23.004Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0e1c228172f35e5a34f1c825ac6ea1e3"],"technology":"aiosmtplib","known_exclusions":[],"conditions_summary":"## Impact\n\nWhen a connection is upgraded with STARTTLS, aiosmtplib reads the server's 220 go-ahead reply and immediately performs the TLS handshake without discarding any data still sitting in the receive buffer. Bytes the protocol read off the plaintext socket before the handshake survive across the plaintext→TLS boundary (the asyncio transport is swapped in place, so the protocol object and its buffer are reused), and are then parsed as though they had arrived inside the TLS session.\n\nWho is affected: Any caller that uses STARTTLS by passing `start_tls=True` or `start_tls=None` when the server advertises STARTTLS, and whose traffic can be intercepted by an active network attacker on the plaintext leg of the connection.\n\nA man in the middle can send, in a single segment immediately after the client's STARTTLS command, the 220 reply followed by attacker-chosen response lines (e.g. 220 Go ahead\\r\\n250-mx.evil\\r\\n250 AUTH LOGIN\\r\\n). aiosmtplib\n  consumes only the 220, leaves the injected lines buffered, completes the handshake, and then parses the attacker's pre-staged plaintext as the first post-TLS server response. This also desynchronizes every\n  subsequent command/response pair ","public_affected_ranges":["<= 5.1.1"]}],"null_published_at":"2026-11-02T10:00:37.157Z","source_updated_at":"2026-08-27T23:32:23.000Z","source_disclosed_at":"2026-08-27T23:32:22.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T09:56:23.004Z"}],"next_cursor":null,"snapshot_revision":"42594"}