CPython imaplib STARTTLS can treat buffered plaintext as TLS
The forwarded notice covers CVE-2026-115559; the snippet gives no versions, fix, or exploitation status.
46
CVE-2026-115559
STARTTLS response injection in CPython imaplib
- CVSS 4.0
- 6.3 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CPython imaplib's IMAP4.starttls() wraps the socket in TLS but leaves its read-ahead buffer uncleared. A network attacker who can append plaintext after the server's tagged OK, without breaking TLS, can have the client treat those bytes as the first responses on the protected channel after a handshake with the real server and a valid certificate. The client may accept a forged CAPABILITY and a forged tagged completion of the next command. Applications using imaplib STARTTLS are affected; affected builds are not listed.
What to do: Apply Python's update for CVE-2026-115559. No workaround is stated.
| Product | Affected |
|---|---|
| Python Software Foundation CPython (imaplib) | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv() as the tagged OK to STARTTLS are returned by readline() after the handshake, so the client treats them as the first responses on the protected channel. A network attacker who cannot break TLS can append forged lines after the server's OK, let the handshake complete with the real server and a valid certificate, and have the client accept the forged CAPABILITY and the forged tagged completion of the next command. This is the STARTTLS command/response injection class of CVE-2011-0411.
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X