CVE-2026-55558: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in cole aiosmtplib

When aiosmtplib upgrades a connection with STARTTLS, it reads the server's 220 reply and immediately starts the TLS handshake without discarding any buffered data. This allows an active network attacker to inject additional response lines immediately after the 220 reply, which remain buffered and are then interpreted as part of the TLS session, causing protocol desynchronization. The vulnerability affects any caller using STARTTLS (start_tls=True or start_tls=None) on versions before 5.1.2. The fix in 5.1.2 enforces discarding any buffered data after the 220 reply before the handshake, per RFC 3207 §4.2.

An active man-in-the-middle attacker on the plaintext leg of a STARTTLS connection can inject malicious response lines that aiosmtplib will parse as part of the encrypted session, causing desynchronization of SMTP commands and responses. This could lead to injection attacks or disruption of the SMTP protocol flow. Passive eavesdroppers cannot exploit this vulnerability. Connections using implicit TLS are not affected.

Upgrade aiosmtplib to version 5.1.2 or later, which includes a fix that discards any buffered data after the 220 STARTTLS reply before the TLS handshake. If immediate upgrade is not possible, use implicit TLS connections by setting use_tls=True to avoid the plaintext phase entirely. Alternatively, restrict STARTTLS connections to servers on trusted network paths to reduce risk from active network attackers.