async-notify (>=0.8.0, <=0.8.11), navigator-api (>=2.3.10, <=2.3.17) potentially affected by CVE-2026-55558 via aiosmtplib (2.0.0)

aiosmtplib PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - async-notify =0.8.0, =2.3.10, =2.3.17 Source cves: CVE-2026-55558 Source advisory: OSV:PYSEC-2026-3805...

async-notify (>=1.0.0, <=1.2.4), async-sender (2.0.0) +2 more potentially affected by CVE-2026-55558 via aiosmtplib (2.0.1)

aiosmtplib PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - async-notify =1.0.0, =0.8.2, =0.1.0, =0.1.6 Source cves: CVE-2026-55558 Source advisory: OSV:PYSEC-2026-3805...

async-sender (3.0.0), hagworm (>=5.9.23, <=5.10.15) potentially affected by CVE-2026-55558 via aiosmtplib (3.0.1)

aiosmtplib PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - async-sender 3.0.0 - hagworm =5.9.23, =5.10.15 Source cves: CVE-2026-55558 Source advisory: OSV:PYSEC-2026-3805...

actions-runtime (>=1.0.1, <=1.0.4), agience-origin (>=0.1.0, <=0.2.8) +20 more potentially affected by CVE-2026-55558 via aiosmtplib (3.0.2)

aiosmtplib PYPI version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - actions-runtime =1.0.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =1.4.2, =1.7.0, =0.2.3, =1.6.52, =1.8.0rc2, =0.1.0, =0.1.2 and more Source cves:...

asphalt-mailer (>=3.0.0, <=3.0.4), async-notify (>=0.6.1, <=0.7.0) +24 more potentially affected by CVE-2026-55558 via aiosmtplib (1.1.7)

aiosmtplib PYPI version 1.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - asphalt-mailer =3.0.0, =0.6.1, =19.7.0, =0.4.0.4, =0.0.1, =0.9.27, =0.0.1, =2.3.0, =2.3.9 - own-comments 0.1.0a4 and more Source cves:...

asphalt-mailer (4.0.0), async-sender (2.0.1) +13 more potentially affected by CVE-2026-55558 via aiosmtplib (2.0.2)

aiosmtplib PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - asphalt-mailer 4.0.0 - async-sender 2.0.1 - axdocsystem =0.1.24, =1.2.3, =0.9.0b19, =0.0.1, =0.1.3, =2.1.5, =2.2.1, =0.1.0, =0.1.5, =0.1.0,...

CVE-2026-55558 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-55558

creationtimestamp| type| source ---|---|--- 2026-08-28 00:31:38+00:00| seen| https://gist.github.com/alon710/a5f4630118da96558b479a90bb02c09c...

async-notify (>=0.5.17, <=0.6.3), async-sender (1.4.4) +8 more potentially affected by CVE-2026-55558 via aiosmtplib (1.1.6)

aiosmtplib PYPI version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - async-notify =0.5.17, =0.1.3, =0.2.3, =1.0.4, =2.0.11, =0.9.13.1, =0.8.4, =0.1.0a0, =0.1.6a0 Source cves: CVE-2026-55558 Source advisory:...

asphalt-mailer (4.0.0), async-sender (2.0.1) +13 more potentially affected by CVE-2026-55558 via aiosmtplib (2.0.2)

aiosmtplib PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - asphalt-mailer 4.0.0 - async-sender 2.0.1 - axdocsystem =0.1.24, =1.2.3, =0.9.0b19, =0.0.1, =0.1.3, =2.1.5, =2.2.1, =0.1.0, =0.1.5, =0.1.0,...

clockwerk (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-55558 via aiosmtplib (4.0.1)

aiosmtplib PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - clockwerk =0.1.0, =0.1.2 Source cves: CVE-2026-55558 Source advisory: OSV:GHSA-VXJ7-4XRP-5VR4...

alert-msgs (0.8.1), arpakitlib (>=1.9.5, <=1.9.61) +21 more potentially affected by CVE-2026-55558 via aiosmtplib (4.0.2)

aiosmtplib PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - alert-msgs 0.8.1 - arpakitlib =1.9.5, =1.5.4, =0.1.1, =1.0.0, =1.0.0, =1.0.0, =0.31.0, =0.31.0, =0.1.0, =0.31.0, =0.0.7, =0.38.0, =0.53.4 an...

async-sender (1.3.4) potentially affected by CVE-2026-55558 via aiosmtplib (1.0.5)

aiosmtplib PYPI version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - async-sender 1.3.4 Source cves: CVE-2026-55558 Source advisory: OSV:GHSA-VXJ7-4XRP-5VR4...

UBUNTU-CVE-2026-55558

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...

CVE-2026-55558 aiosmtplib: STARTTLS response injection

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...

CVE-2026-55558

CVE-2026-55558 affects aiosmtplib , an asynchronous SMTP client for Python's asyncio, in versions prior to 5.1.2 . The vulnerability resides in SMTPProtocol.start_tls (src/aiosmtplib/protocol.py), which consumes the server's 220 response and initiates the TLS handshake without clearing SMTPProtoc...

actions-runtime (>=1.0.1, <=1.0.4), agience-origin (>=0.1.0, <=0.2.8) +94 more potentially affected by CVE-2026-55558 via aiosmtplib (>=1.0.3, <=5.1.0)

aiosmtplib PYPI version =1.0.3, =1.0.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =1.9.5, =3.0.0, =0.5.17, =1.3.0, =0.0.3, =0.39.0, =0.1.24, =0.1.52 - backend-ai-manager 25.6.0rc4 and more Source cves: CVE-2026-55558 Source advisory: MEND:CVE-2026-55558...