Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    GHSA-V3Q9-HJ7J-63HQ

    Vulnerability from github – Published: 2026-07-07 23:40 – Updated: 2026-07-07 23:40
    VLAI
    Summary
    aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address
    Details

    Summary

    aiosmtplib's SMTP.mail(), SMTP.rcpt(), SMTP.vrfy() and SMTP.expn() send the caller-supplied email address to the server without rejecting embedded CR/LF (\r\n) bytes. An address that contains a CR/LF is written verbatim onto the SMTP control connection, so the bytes after the CRLF are framed by the server as one or more additional, standalone SMTP command lines. A caller that passes an attacker-influenced sender or recipient address into mail()/rcpt() (or vrfy()/expn()) therefore allows SMTP command injection (CWE-93 / CWE-77): the attacker can smuggle arbitrary SMTP verbs such as MAIL FROM, RCPT TO, RSET, DATA, or AUTH into the session. Injected commands will cause the SMTP instance to hang, but all commands required to complete the envelope could be sent in one address string.

    The SMTP.sendmail() command will pass sender and recipient addresses verbatim through to SMTP.mail() & SMTP.rcpt(), and so is also vulnerable. SMTP.send_message() is not affected.

    Impact

    Severity: medium. Type: SMTP protocol command injection (CWE-93 — Improper Neutralization of CRLF Sequences; CWE-77 — Command Injection).

    When an application built on aiosmtplib derives the envelope sender or any recipient from data an attacker can influence (a web form etc.) and passes it to mail()/rcpt() (directly, or via sendmail()/send() without a Message object), the attacker can:

    • desynchronize the command/response pipeline and cause the aiosmtplib client to hang, resulting in a possible denial of service
    • inject multiple commands in one address to send an arbitrary message

    The address only needs to reach mail()/rcpt()/vrfy()/expn(); no attacker control over the SMTP server is required.

    Vulnerable versions

    Affected version: aiosmtplib 5.1.0 (latest at time of report) and all earlier releases.

    Credit

    Reported by tonghuaroot.

    Severity
    6.9 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:H/SA:N
    Show details on source website
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.1.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "aiosmtplib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53533"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77",
      "CWE-93"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-07T23:40:52Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`aiosmtplib`\u0027s `SMTP.mail()`, `SMTP.rcpt()`, `SMTP.vrfy()` and `SMTP.expn()` send the caller-supplied email address to the server without rejecting embedded CR/LF (`\\r\\n`) bytes. An address that contains a CR/LF is written verbatim onto the SMTP control connection, so the bytes after the CRLF are framed by the server as one or more **additional, standalone SMTP command lines**. A caller that passes an attacker-influenced sender or recipient address into `mail()`/`rcpt()` (or `vrfy()`/`expn()`) therefore allows **SMTP command injection** (CWE-93 / CWE-77): the attacker can smuggle arbitrary SMTP verbs such as `MAIL FROM`, `RCPT TO`, `RSET`, `DATA`, or `AUTH` into the session. Injected commands will cause the `SMTP` instance to hang, but all commands required to complete the envelope could be sent in one address string.\n\nThe `SMTP.sendmail()` command will pass sender and recipient addresses verbatim through to `SMTP.mail()` \u0026 `SMTP.rcpt()`, and so is also vulnerable. `SMTP.send_message()` is not affected.\n\n### Impact\n\nSeverity: medium. Type: SMTP protocol command injection (CWE-93 \u2014 Improper Neutralization of CRLF Sequences; CWE-77 \u2014 Command Injection).\n\nWhen an application built on `aiosmtplib` derives the envelope sender or any recipient from data an attacker can influence (a web form etc.) and passes it to `mail()`/`rcpt()` (directly, or via `sendmail()`/`send()` without a `Message` object), the attacker can:\n\n- desynchronize the command/response pipeline and cause the aiosmtplib client to hang, resulting in a possible denial of service\n- inject multiple commands in one address to send an arbitrary message\n\nThe address only needs to reach `mail()`/`rcpt()`/`vrfy()`/`expn()`; no attacker control over the SMTP server is required.\n\n### Vulnerable versions\n\nAffected version: `aiosmtplib` 5.1.0 (latest at time of report) and all earlier releases.\n\n### Credit\n\nReported by tonghuaroot.",
  "id": "GHSA-v3q9-hj7j-63hq",
  "modified": "2026-07-07T23:40:52Z",
  "published": "2026-07-07T23:40:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cole/aiosmtplib/security/advisories/GHSA-v3q9-hj7j-63hq"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cole/aiosmtplib"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address"
}

    OPENSUSE-SU-2026:11035-1

    Vulnerability from csaf_opensuse - Published: 2026-06-15 00:00 - Updated: 2026-06-15 00:00
    Summary
    python311-aiosmtplib-5.1.1-1.1 on GA media
    Severity
    Moderate
    Notes
    Title of the patch: python311-aiosmtplib-5.1.1-1.1 on GA media
    Description of the patch: These are all security issues fixed in the python311-aiosmtplib-5.1.1-1.1 package on the GA media of openSUSE Tumbleweed.
    Patchnames: openSUSE-Tumbleweed-2026-11035
    Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
    CVE-2026-53533
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    Affected products
    Product Identifier Version Remediation
    Unresolved product id: openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.aarch64 —
    Vendor Fix
    Unresolved product id: openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.ppc64le —
    Vendor Fix
    Unresolved product id: openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.s390x —
    Vendor Fix
    Unresolved product id: openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.x86_64 —
    Vendor Fix
    Unresolved product id: openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.aarch64 —
    Vendor Fix
    Unresolved product id: openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.ppc64le —
    Vendor Fix
    Unresolved product id: openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.s390x —
    Vendor Fix
    Unresolved product id: openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.x86_64 —
    Vendor Fix
    Unresolved product id: openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.aarch64 —
    Vendor Fix
    Unresolved product id: openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.ppc64le —
    Vendor Fix
    Unresolved product id: openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.s390x —
    Vendor Fix
    Unresolved product id: openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.x86_64 —
    Vendor Fix
    Threats
    Impact moderate
    References
    To clipboard 

    {
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python311-aiosmtplib-5.1.1-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python311-aiosmtplib-5.1.1-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11035",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11035-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-53533 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-53533/"
      }
    ],
    "title": "python311-aiosmtplib-5.1.1-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-06-15T00:00:00Z",
      "generator": {
        "date": "2026-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11035-1",
      "initial_release_date": "2026-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-aiosmtplib-5.1.1-1.1.aarch64",
                "product": {
                  "name": "python311-aiosmtplib-5.1.1-1.1.aarch64",
                  "product_id": "python311-aiosmtplib-5.1.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-aiosmtplib-5.1.1-1.1.aarch64",
                "product": {
                  "name": "python313-aiosmtplib-5.1.1-1.1.aarch64",
                  "product_id": "python313-aiosmtplib-5.1.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python314-aiosmtplib-5.1.1-1.1.aarch64",
                "product": {
                  "name": "python314-aiosmtplib-5.1.1-1.1.aarch64",
                  "product_id": "python314-aiosmtplib-5.1.1-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-aiosmtplib-5.1.1-1.1.ppc64le",
                "product": {
                  "name": "python311-aiosmtplib-5.1.1-1.1.ppc64le",
                  "product_id": "python311-aiosmtplib-5.1.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python313-aiosmtplib-5.1.1-1.1.ppc64le",
                "product": {
                  "name": "python313-aiosmtplib-5.1.1-1.1.ppc64le",
                  "product_id": "python313-aiosmtplib-5.1.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python314-aiosmtplib-5.1.1-1.1.ppc64le",
                "product": {
                  "name": "python314-aiosmtplib-5.1.1-1.1.ppc64le",
                  "product_id": "python314-aiosmtplib-5.1.1-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-aiosmtplib-5.1.1-1.1.s390x",
                "product": {
                  "name": "python311-aiosmtplib-5.1.1-1.1.s390x",
                  "product_id": "python311-aiosmtplib-5.1.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python313-aiosmtplib-5.1.1-1.1.s390x",
                "product": {
                  "name": "python313-aiosmtplib-5.1.1-1.1.s390x",
                  "product_id": "python313-aiosmtplib-5.1.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python314-aiosmtplib-5.1.1-1.1.s390x",
                "product": {
                  "name": "python314-aiosmtplib-5.1.1-1.1.s390x",
                  "product_id": "python314-aiosmtplib-5.1.1-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-aiosmtplib-5.1.1-1.1.x86_64",
                "product": {
                  "name": "python311-aiosmtplib-5.1.1-1.1.x86_64",
                  "product_id": "python311-aiosmtplib-5.1.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-aiosmtplib-5.1.1-1.1.x86_64",
                "product": {
                  "name": "python313-aiosmtplib-5.1.1-1.1.x86_64",
                  "product_id": "python313-aiosmtplib-5.1.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python314-aiosmtplib-5.1.1-1.1.x86_64",
                "product": {
                  "name": "python314-aiosmtplib-5.1.1-1.1.x86_64",
                  "product_id": "python314-aiosmtplib-5.1.1-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-aiosmtplib-5.1.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.aarch64"
        },
        "product_reference": "python311-aiosmtplib-5.1.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-aiosmtplib-5.1.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.ppc64le"
        },
        "product_reference": "python311-aiosmtplib-5.1.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-aiosmtplib-5.1.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.s390x"
        },
        "product_reference": "python311-aiosmtplib-5.1.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-aiosmtplib-5.1.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.x86_64"
        },
        "product_reference": "python311-aiosmtplib-5.1.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiosmtplib-5.1.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.aarch64"
        },
        "product_reference": "python313-aiosmtplib-5.1.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiosmtplib-5.1.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.ppc64le"
        },
        "product_reference": "python313-aiosmtplib-5.1.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiosmtplib-5.1.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.s390x"
        },
        "product_reference": "python313-aiosmtplib-5.1.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiosmtplib-5.1.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.x86_64"
        },
        "product_reference": "python313-aiosmtplib-5.1.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-aiosmtplib-5.1.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.aarch64"
        },
        "product_reference": "python314-aiosmtplib-5.1.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-aiosmtplib-5.1.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.ppc64le"
        },
        "product_reference": "python314-aiosmtplib-5.1.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-aiosmtplib-5.1.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.s390x"
        },
        "product_reference": "python314-aiosmtplib-5.1.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-aiosmtplib-5.1.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.x86_64"
        },
        "product_reference": "python314-aiosmtplib-5.1.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-53533",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-53533"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.aarch64",
          "openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.s390x",
          "openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.x86_64",
          "openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-53533",
          "url": "https://www.suse.com/security/cve/CVE-2026-53533"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268219 for CVE-2026-53533",
          "url": "https://bugzilla.suse.com/1268219"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.aarch64",
            "openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.s390x",
            "openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.x86_64",
            "openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.aarch64",
            "openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.s390x",
            "openSUSE Tumbleweed:python311-aiosmtplib-5.1.1-1.1.x86_64",
            "openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-aiosmtplib-5.1.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-aiosmtplib-5.1.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-53533"
    }
  ]
}

    PYSEC-2026-2338

    Vulnerability from pysec - Published: 2026-07-13 15:46 - Updated: 2026-07-13 16:03
    VLAI
    Details

    Summary

    aiosmtplib's SMTP.mail(), SMTP.rcpt(), SMTP.vrfy() and SMTP.expn() send the caller-supplied email address to the server without rejecting embedded CR/LF (\r\n) bytes. An address that contains a CR/LF is written verbatim onto the SMTP control connection, so the bytes after the CRLF are framed by the server as one or more additional, standalone SMTP command lines. A caller that passes an attacker-influenced sender or recipient address into mail()/rcpt() (or vrfy()/expn()) therefore allows SMTP command injection (CWE-93 / CWE-77): the attacker can smuggle arbitrary SMTP verbs such as MAIL FROM, RCPT TO, RSET, DATA, or AUTH into the session. Injected commands will cause the SMTP instance to hang, but all commands required to complete the envelope could be sent in one address string.

    The SMTP.sendmail() command will pass sender and recipient addresses verbatim through to SMTP.mail() & SMTP.rcpt(), and so is also vulnerable. SMTP.send_message() is not affected.

    Impact

    Severity: medium. Type: SMTP protocol command injection (CWE-93 — Improper Neutralization of CRLF Sequences; CWE-77 — Command Injection).

    When an application built on aiosmtplib derives the envelope sender or any recipient from data an attacker can influence (a web form etc.) and passes it to mail()/rcpt() (directly, or via sendmail()/send() without a Message object), the attacker can:

    • desynchronize the command/response pipeline and cause the aiosmtplib client to hang, resulting in a possible denial of service
    • inject multiple commands in one address to send an arbitrary message

    The address only needs to reach mail()/rcpt()/vrfy()/expn(); no attacker control over the SMTP server is required.

    Vulnerable versions

    Affected version: aiosmtplib 5.1.0 (latest at time of report) and all earlier releases.

    Credit

    Reported by tonghuaroot.

    Severity
    6.9 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:H/SA:N
    Impacted products
    Name purl
    aiosmtplib pkg:pypi/aiosmtplib
    Aliases
    To clipboard 

    {
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "aiosmtplib",
        "purl": "pkg:pypi/aiosmtplib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1",
        "0.1.2",
        "0.1.3",
        "0.1.4",
        "0.1.5rc2",
        "0.1.6",
        "0.1.7",
        "1.0.0",
        "1.0.1",
        "1.0.2",
        "1.0.3",
        "1.0.4",
        "1.0.5",
        "1.0.6",
        "1.1.0",
        "1.1.1",
        "1.1.2",
        "1.1.3",
        "1.1.4",
        "1.1.5",
        "1.1.6",
        "1.1.7",
        "1.1b0",
        "2.0.0",
        "2.0.0b0",
        "2.0.0b1",
        "2.0.1",
        "2.0.2",
        "3.0.0",
        "3.0.1",
        "3.0.2",
        "4.0.0",
        "4.0.1",
        "4.0.2",
        "5.0.0",
        "5.1.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53533",
    "GHSA-v3q9-hj7j-63hq"
  ],
  "details": "### Summary\n\n`aiosmtplib`\u0027s `SMTP.mail()`, `SMTP.rcpt()`, `SMTP.vrfy()` and `SMTP.expn()` send the caller-supplied email address to the server without rejecting embedded CR/LF (`\\r\\n`) bytes. An address that contains a CR/LF is written verbatim onto the SMTP control connection, so the bytes after the CRLF are framed by the server as one or more **additional, standalone SMTP command lines**. A caller that passes an attacker-influenced sender or recipient address into `mail()`/`rcpt()` (or `vrfy()`/`expn()`) therefore allows **SMTP command injection** (CWE-93 / CWE-77): the attacker can smuggle arbitrary SMTP verbs such as `MAIL FROM`, `RCPT TO`, `RSET`, `DATA`, or `AUTH` into the session. Injected commands will cause the `SMTP` instance to hang, but all commands required to complete the envelope could be sent in one address string.\n\nThe `SMTP.sendmail()` command will pass sender and recipient addresses verbatim through to `SMTP.mail()` \u0026 `SMTP.rcpt()`, and so is also vulnerable. `SMTP.send_message()` is not affected.\n\n### Impact\n\nSeverity: medium. Type: SMTP protocol command injection (CWE-93 \u2014 Improper Neutralization of CRLF Sequences; CWE-77 \u2014 Command Injection).\n\nWhen an application built on `aiosmtplib` derives the envelope sender or any recipient from data an attacker can influence (a web form etc.) and passes it to `mail()`/`rcpt()` (directly, or via `sendmail()`/`send()` without a `Message` object), the attacker can:\n\n- desynchronize the command/response pipeline and cause the aiosmtplib client to hang, resulting in a possible denial of service\n- inject multiple commands in one address to send an arbitrary message\n\nThe address only needs to reach `mail()`/`rcpt()`/`vrfy()`/`expn()`; no attacker control over the SMTP server is required.\n\n### Vulnerable versions\n\nAffected version: `aiosmtplib` 5.1.0 (latest at time of report) and all earlier releases.\n\n### Credit\n\nReported by tonghuaroot.",
  "id": "PYSEC-2026-2338",
  "modified": "2026-07-13T16:03:20.193292Z",
  "published": "2026-07-13T15:46:29.471704Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cole/aiosmtplib/security/advisories/GHSA-v3q9-hj7j-63hq"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cole/aiosmtplib"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/aiosmtplib"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-v3q9-hj7j-63hq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53533"
    }
  ],
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address"
}