PYSEC-2026-2338 aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address

Summary aiosmtplib's SMTP.mail, SMTP.rcpt, SMTP.vrfy and SMTP.expn send the caller-supplied email address to the server without rejecting embedded CR/LF \r\n bytes. An address that contains a CR/LF is written verbatim onto the SMTP control connection, so the bytes after the CRLF are framed by the...

GHSA-V3Q9-HJ7J-63HQ aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address

Summary aiosmtplib's SMTP.mail, SMTP.rcpt, SMTP.vrfy and SMTP.expn send the caller-supplied email address to the server without rejecting embedded CR/LF \r\n bytes. An address that contains a CR/LF is written verbatim onto the SMTP control connection, so the bytes after the CRLF are framed by the...

PT-2026-49732

Name of the Vulnerable Software and Affected Versions aiosmtplib versions prior to 5.1.1 Description The software fails to reject embedded carriage return and line feed CRLF bytes in email addresses. When a caller-supplied address containing these bytes is passed to the SMTP.mail, SMTP.rcpt,...

OPENSUSE-SU-2026:11035-1 python311-aiosmtplib-5.1.1-1.1 on GA media

These are all security issues fixed in the python311-aiosmtplib-5.1.1-1.1 package on the GA media of openSUSE Tumbleweed...

async-notify (>=0.5.17 <=0.6.3), async-sender (>=1.3.0 <=1.4.4) +11 more potentially affected by unknown CVE via aiosmtplib (>=1.0.3 <=1.1.6)

aiosmtplib PYPI version =1.0.3, =0.5.17, =1.3.0, =0.0.3, =0.39.0, =0.2.3, =0.0.1, =0.1.1, =1.0.4, =2024.10.27.post1, =0.9.0, =0.8.4, =0.1.0a0, =0.1.6a0 Source cves: unknown CVE Source advisory: SNYK:PYTHON-AIOSMTPLIB-3042406...

SMTP Injection

Overview aiosmtplib is an aiosmtplib is an asynchronous SMTP client for use with asyncio. Affected versions of this package are vulnerable to SMTP Injection. It is possible to insert an arbitrary SMTP command through the hostname or the sourceaddress field. PoC python import asyncio from...