Update dependency aiosmtplib to v5 [SECURITY] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
aiosmtplib (changelog)	==3.0.2 → ==5.1.2

---

aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address

CVE-2026-53533 / GHSA-v3q9-hj7j-63hq

More information

Details

Summary

aiosmtplib's SMTP.mail(), SMTP.rcpt(), SMTP.vrfy() and SMTP.expn() send the caller-supplied email address to the server without rejecting embedded CR/LF (\r\n) bytes. An address that contains a CR/LF is written verbatim onto the SMTP control connection, so the bytes after the CRLF are framed by the server as one or more additional, standalone SMTP command lines. A caller that passes an attacker-influenced sender or recipient address into mail()/rcpt() (or vrfy()/expn()) therefore allows SMTP command injection (CWE-93 / CWE-77): the attacker can smuggle arbitrary SMTP verbs such as MAIL FROM, RCPT TO, RSET, DATA, or AUTH into the session. Injected commands will cause the SMTP instance to hang, but all commands required to complete the envelope could be sent in one address string.

The SMTP.sendmail() command will pass sender and recipient addresses verbatim through to SMTP.mail() & SMTP.rcpt(), and so is also vulnerable. SMTP.send_message() is not affected.

Impact

Severity: medium. Type: SMTP protocol command injection (CWE-93 — Improper Neutralization of CRLF Sequences; CWE-77 — Command Injection).

When an application built on aiosmtplib derives the envelope sender or any recipient from data an attacker can influence (a web form etc.) and passes it to mail()/rcpt() (directly, or via sendmail()/send() without a Message object), the attacker can:

• desynchronize the command/response pipeline and cause the aiosmtplib client to hang, resulting in a possible denial of service
• inject multiple commands in one address to send an arbitrary message

The address only needs to reach mail()/rcpt()/vrfy()/expn(); no attacker control over the SMTP server is required.

Vulnerable versions

Affected version: aiosmtplib 5.1.0 (latest at time of report) and all earlier releases.

Credit

Reported by tonghuaroot.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:H/SA:N

References

• https://github.com/cole/aiosmtplib/security/advisories/GHSA-v3q9-hj7j-63hq
• https://github.com/advisories/GHSA-v3q9-hj7j-63hq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

aiosmtplib: STARTTLS response injection

CVE-2026-55558 / GHSA-vxj7-4xrp-5vr4

More information

Details

Impact

When a connection is upgraded with STARTTLS, aiosmtplib reads the server's 220 go-ahead reply and immediately performs the TLS handshake without discarding any data still sitting in the receive buffer. Bytes the protocol read off the plaintext socket before the handshake survive across the plaintext→TLS boundary (the asyncio transport is swapped in place, so the protocol object and its buffer are reused), and are then parsed as though they had arrived inside the TLS session.

Who is affected: Any caller that uses STARTTLS by passing start_tls=True or start_tls=None when the server advertises STARTTLS, and whose traffic can be intercepted by an active network attacker on the plaintext leg of the connection.

A man in the middle can send, in a single segment immediately after the client's STARTTLS command, the 220 reply followed by attacker-chosen response lines (e.g. 220 Go ahead\r\n250-mx.evil\r\n250 AUTH LOGIN\r\n). aiosmtplib
consumes only the 220, leaves the injected lines buffered, completes the handshake, and then parses the attacker's pre-staged plaintext as the first post-TLS server response. This also desynchronizes every
subsequent command/response pair inside the "encrypted" session.

Not affected: Connections using implicit/direct TLS (use_tls=True) have no plaintext phase and are not vulnerable. The attack requires an active man in the middle via network compromise; a passive eavesdropper cannot exploit it.

Patches

A fix is available in aiosmtplib 5.1.2. All earlier versions that support STARTTLS are affected; upgrade to 5.1.2 or
later.

The fix treats any data buffered after the 220 STARTTLS reply and before the handshake as a protocol violation, per RFC 3207 §4.2 ("the client MUST discard any knowledge obtained from the server … which was not
obtained from the TLS negotiation itself").

Workarounds

If you cannot upgrade immediately:

• Use implicit TLS instead of STARTTLS. Connect with use_tls=True. This removes the plaintext phase entirely.
• If STARTTLS is unavoidable, restrict connections to servers reached over a trusted network path.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/cole/aiosmtplib/security/advisories/GHSA-vxj7-4xrp-5vr4
• https://nvd.nist.gov/vuln/detail/CVE-2026-55558
• https://github.com/cole/aiosmtplib/commit/9fab7ba1361dbf7622ede1315a24be805cff09c9
• https://github.com/cole/aiosmtplib/releases/tag/v5.1.2
• https://github.com/advisories/GHSA-vxj7-4xrp-5vr4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

cole/aiosmtplib (aiosmtplib)

v5.1.2

Compare Source

• Security: Discard any buffered server data before the STARTTLS handshake,
  preventing a response-injection attack where a man-in-the-middle pre-stages
  plaintext that would otherwise be read as part of the encrypted session.
  More details: GHSA-vxj7-4xrp-5vr4
• Bugfix: Corrected SMTPResponse __repr__ result
• Bugfix: Calling connect() on an already-connected client now raises
  SMTPException instead of deadlocking on the connection lock
• Feature: Poe command runner for dev tasks
• Bugfix: Timeout ignored during CRAM-MD5 verification
• Bugfix: Only parse EHLO response after validating success
• Bugfix: return None from extract_sender when address list is empty
• Bugfix: Enforce a maximum total response size, preventing unbounded memory
  use if a server streams data with no line ending or endless multiline
  continuation lines
• Bugfix: Use the invalid_response status code (-1) instead of 500 when a
  server response line exceeds the maximum length
• Bugfix: A read timeout now closes the connection instead of leaving it in a
  desynced state, where a late server response could be mispaired with a
  subsequent command
• Bugfix: Correctly parse old-style AUTH= extension advertisements; all
  advertised methods are now kept (e.g. both PLAIN and LOGIN from
  AUTH=PLAIN LOGIN)
• Bugfix: ESMTP extension lines with leading whitespace are no
  longer ignored

v5.1.1

Compare Source

• Security: Reject control characters (the C0 range 0x00-0x1F and DEL
  0x7F, including CR, LF, and NUL) in SMTP command arguments, preventing
  command injection via input passed to mail(), rcpt(), vrfy(),
  expn() or sendmail(). Such input now raises ValueError before
  anything is written to the connection.
  More details: GHSA-v3q9-hj7j-63hq
  Thanks to @​tonghuaroot for the report.
• Bugfix: SMTP.quit() no longer hangs until the read timeout when the
  peer drops the transport with an exception after QUIT is sent but
  before the 221 reply is parsed (e.g. AWS SES closing TLS without
  close_notify).

v5.1.0

Compare Source

• Feature: Add XOAUTH2 authentication support

v5.0.0

Compare Source

• BREAKING: Drop Python 3.9 support

v4.0.2

Compare Source

• Bugfix: correct aexit signature to comply with async context manager protocol
  (thanks @​oliverlambson)

v4.0.1

Compare Source

• Bugfix: Always clear the connect lock on connection lost, allowing client reconnect

v4.0.0

Compare Source

• BREAKING: Drop Python 3.8 support
• Bugfix: Run socket.getfqdn in thread to avoid blocking event loop
  if local_hostname not provided (thanks @​Raidzin)
• Bugfix: Clear connect lock on connection lost, allowing client reconnect
• Bugfix: Allow socket connections to use TLS by providing hostname and
  use_tls=True

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.