AZL-113323 CVE-2026-115559 affecting package python-py 1.11.0-1

IMAP4.starttls wraps the socket in TLS but leaves self.readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv as the tagged OK to STARTTLS are returned by readline after the handshake, so the client treats them as the first responses on the protecte...

CVE-2026-115559 imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS

IMAP4.starttls wraps the socket in TLS but leaves self.readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv as the tagged OK to STARTTLS are returned by readline after the handshake, so the client treats them as the first responses on the protecte...

CVE-2026-115559

IMAP4.starttls wraps the socket in TLS but leaves self.readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv as the tagged OK to STARTTLS are returned by readline after the handshake, so the client treats them as the first responses on the protecte...