UBUNTU-CVE-2026-115559

IMAP4.starttls wraps the socket in TLS but leaves self.readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv as the tagged OK to STARTTLS are returned by readline after the handshake, so the client treats them as the first responses on the protecte...

AZL-113323 CVE-2026-115559 affecting package python-py 1.11.0-1

IMAP4.starttls wraps the socket in TLS but leaves self.readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv as the tagged OK to STARTTLS are returned by readline after the handshake, so the client treats them as the first responses on the protecte...

AZL-113329 CVE-2026-115559 affecting package python3 3.12.16-2

IMAP4.starttls wraps the socket in TLS but leaves self.readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv as the tagged OK to STARTTLS are returned by readline after the handshake, so the client treats them as the first responses on the protecte...

CVE-2026-115559 imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS

IMAP4.starttls wraps the socket in TLS but leaves self.readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv as the tagged OK to STARTTLS are returned by readline after the handshake, so the client treats them as the first responses on the protecte...

CVE-2026-115559

IMAP4.starttls wraps the socket in TLS but leaves self.readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv as the tagged OK to STARTTLS are returned by readline after the handshake, so the client treats them as the first responses on the protecte...

CVE-2026-115559

The imaplib library in Python is vulnerable to a STARTTLS command/response injection (similar to CVE-2011-0411). The IMAP4.starttls() function wraps the socket in TLS but fails to clear the self._readbuf read-ahead buffer. Consequently, plaintext bytes received during the recv() call for the STAR...

PT-2026-144403

IMAP4.starttls wraps the socket in TLS but leaves self. readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv as the tagged OK to STARTTLS are returned by readline after the handshake, so the client treats them as the first responses on the protect...