The flaw occurs when the aiosmtplib library starts a TLS handshake after receiving the server’s 220 greeting without clearing the internal buffer. This allows an active network attacker to place additional SMTP response lines between the plaintext 220 reply and the TLS upgrade. Those injected bytes are then parsed as the first response inside the encrypted session, breaking the correspondence between subsequent SMTP commands and responses and opening the door to unintended command execution inside the TLS channel. The weakness is an input handling flaw identified as CWE-74.

The vulnerability affects Python applications that use the aiosmtplib library prior to version 5.1.2 when configuring the client with start_tls=True or opportunistic STARTTLS for a secure connection. Connections that use the use_tls=True option are unaffected. Any system – such as mail relays, automated email senders, or services relying on aiosmtplib for email delivery – that embeds a vulnerable library version is at risk.

With a CVSS score of 5.9 the risk is moderate; the EPSS score is not published, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network attacker on the same segment who can inject additional response lines before the TLS layer is established. Exploitation requires the ability to observe and modify the SMTP traffic between the client and the server, which is feasible on insecure or shared networks. As a result, an attacker could interfere with mail flow or potentially execute arbitrary SMTP commands in an encrypted session.