CPython imaplib STARTTLS can treat buffered plaintext as TLS
Original title: CPython: [CVE-2026-115559] imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS
The forwarded notice covers CVE-2026-115559; the snippet gives no versions, fix, or exploitation status.
A Python security announcement forwarded to oss-security describes CVE-2026-115559 in CPython’s imaplib. STARTTLS can serve plaintext bytes buffered before the handshake as if they arrived over TLS. The available text does not state affected versions, a fix, or exploitation.
Unconfirmed: Affected versions, a fix, and any exploitation are not stated in the snippet.
- Jelle Zijlstra sent the notice to security-announce on November 10, 2026.
- Alan Coopersmith forwarded it to oss-security the same day.
- No affected or fixed versions appear in the available text.
Impact: Plaintext bytes treated as if received over TLS
| Product | Affected |
|---|---|
| Python CPython | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115559 | STARTTLS response injection in CPython imaplib | 6.3 | — |
From the original article
Posted by Alan Coopersmith on Nov 10 -------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-115559] imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS Date: Tue, 10 Nov 2026 09:41:54 -0800 From: Jelle Zijlstra via Security-announce Reply-To: security-sig () python org To: security-announce () python org CC: Jelle Zijlstra <jelle. zijlstra () gmail...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.