CVE-2024-27305
SMTP smuggling in aiosmtpd
aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
SMTP smuggling in aiosmtpd
aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-27305- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-345
- Updated
- 2026-11-02
EUVDEUVD-2024-0215
aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
EUVD-2024-0215- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pr2m-px7j-xg65
aiosmtpd vulnerable to SMTP smuggling
Summary
aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue also existed in other SMTP software like Postfix (https://www.postfix.org/smtp-smuggling.html).
Details
Detailed information on SMTP smuggling can be found in the full blog post (https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/) or on the Postfix homepage (https://www.postfix.org/smtp-smuggling.html). (and soon on the official website https://smtpsmuggling.com/)
Impact
With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances.
- Record
GHSA-pr2m-px7j-xg65- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-345
- Updated
- 2026-11-02
NVD
aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-27305- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-345
- Updated
- 2026-11-02
OSV
SMTP smuggling in aiosmtpd
aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-27305- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-345
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-27305
aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
DEBIAN-CVE-2024-27305- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 10 moreShow less
OSVGHSA-pr2m-px7j-xg65
aiosmtpd vulnerable to SMTP smuggling
Summary
aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue also existed in other SMTP software like Postfix (https://www.postfix.org/smtp-smuggling.html).
Details
Detailed information on SMTP smuggling can be found in the full blog post (https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/) or on the Postfix homepage (https://www.postfix.org/smtp-smuggling.html). (and soon on the official website https://smtpsmuggling.com/)
Impact
With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances.
- Record
GHSA-pr2m-px7j-xg65- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-345
- Updated
- 2026-11-02
OSVOESA-2024-1276
python-aiosmtpd security update
This is a server for SMTP and related protocols, similar in utility to the standard library's smtpd.py module, but rewritten to be based on asyncio for Python 3.
Security Fix(es):
aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-27305)
- Record
OESA-2024-1276- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2024-1320
python-aiosmtpd security update
This is a server for SMTP and related protocols, similar in utility to the standard library's smtpd.py module, but rewritten to be based on asyncio for Python 3.
Security Fix(es):
aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-27305)
- Record
OESA-2024-1320- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2024-1321
python-aiosmtpd security update
This is a server for SMTP and related protocols, similar in utility to the standard library's smtpd.py module, but rewritten to be based on asyncio for Python 3.
Security Fix(es):
aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-27305)
- Record
OESA-2024-1321- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2024-1322
python-aiosmtpd security update
This is a server for SMTP and related protocols, similar in utility to the standard library's smtpd.py module, but rewritten to be based on asyncio for Python 3.
Security Fix(es):
aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-27305)
- Record
OESA-2024-1322- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVPYSEC-2024-221
aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
PYSEC-2024-221- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-27305
aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
UBUNTU-CVE-2024-27305- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:0243-1 No score
Security update for python-aiosmtpd
This update for python-aiosmtpd fixes the following issues:
- CVE-2024-34083: Fixed MiTM attack could inject extra unencrypted commands after STARTTLS (boo#1224467)
- CVE-2024-27305: Fixed SMTP smuggling (boo#1221328)
- Record
openSUSE-SU-2024:0243-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13774-1 No score
python310-aiosmtpd-1.4.5-2.1 on GA media
These are all security issues fixed in the python310-aiosmtpd-1.4.5-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13774-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11675-1 No score
python313-aiosmtpd-1.4.6-6.1 on GA media
These are all security issues fixed in the python313-aiosmtpd-1.4.6-6.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11675-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aiosmtpdPyPI |
before 1.4.5 | 1.4.5 |
python-aiosmtpdDebian:12 |
before 1.4.3-1.1+deb12u1, plus listed versions 1.4.3-1.1 |
1.4.3-1.1+deb12u1 |
python-aiosmtpdDebian:13 |
before 1.4.6-1 | 1.4.6-1 |
python-aiosmtpdDebian:14 |
before 1.4.6-1 | 1.4.6-1 |
aiosmtpdPyPI |
before 1.4.5, plus listed versions 1.01.0a11.0a21.0a31.0a4 Show 19 moreShow less1.0a51.0b11.0rc11.11.21.2.21.2.41.3.01.3.11.3.21.4.01.4.11.4.21.4.31.4.3rc11.4.3rc21.4.41.4.4.post11.4.4.post2 |
1.4.5 |
python-aiosmtpdopenEuler:22.03-LTS |
before 1.4.2-2.oe2203 | 1.4.2-2.oe2203 |
python-aiosmtpdopenEuler:22.03-LTS-SP1 |
before 1.4.2-2.oe2203sp1 | 1.4.2-2.oe2203sp1 |
python-aiosmtpdopenEuler:22.03-LTS-SP2 |
before 1.4.2-2.oe2203sp2 | 1.4.2-2.oe2203sp2 |
python-aiosmtpdopenEuler:22.03-LTS-SP3 |
before 1.4.2-2.oe2203sp3 | 1.4.2-2.oe2203sp3 |
aiosmtpdPyPI |
before 1.4.5, plus listed versions 1.01.0a11.0a21.0a31.0a4 Show 24 moreShow less1.0a51.0b11.0rc11.11.21.2.21.2.41.3.01.3.11.3.21.4.01.4.11.4.21.4.31.4.3rc11.4.3rc21.4.41.4.4.post11.4.4.post21.3.0a31.3.0a21.2.31.2.11.2-rc |
1.4.5 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-aiosmtpdUbuntu:18.04:LTS |
All versions, plus listed versions 1.1-31.1-41.1-5 |
None known |
python-aiosmtpdUbuntu:20.04:LTS |
All versions, plus listed versions 1.2-3 |
None known |
python-aiosmtpdUbuntu:22.04:LTS |
All versions, plus listed versions 1.2.2-11.4.2-3 |
None known |
python-aiosmtpdUbuntu:24.04:LTS |
All versions, plus listed versions 1.4.3-1.11.4.4.post2-1 |
None known |
python-aiosmtpdUbuntu:25.10 |
All versions, plus listed versions 1.4.6-5 |
None known |
python-aiosmtpdUbuntu:26.10 |
All versions, plus listed versions 1.4.6-61.4.6-7 |
None known |
python-aiosmtpdUbuntu:26.04:LTS |
All versions, plus listed versions 1.4.6-51.4.6-6 |
None known |
python-aiosmtpdSUSE:Package Hub 15 SP5 From an advisory covering 2 CVEs |
before 1.2.1-bp155.3.3.1 | 1.2.1-bp155.3.3.1 |
python-aiosmtpdopenSUSE:Leap 15.5 From an advisory covering 2 CVEs |
before 1.2.1-bp155.3.3.1 | 1.2.1-bp155.3.3.1 |
python-aiosmtpdopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.4.6-6.1 | 1.4.6-6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-27305 is a medium vulnerability (CVSS 5.3) in Aio-libs Aiosmtpd, published March 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in aiosmtpd 1.4.5.
References
github.com/aio-libs/aiosmtpd/security/advisories/GHSA-pr2m-px7j-xg65
postfix.org/smtp-smuggling.html
nvd.nist.gov/vuln/detail/CVE-2024-27305
Show 14 moreShow less
security-tracker.debian.org/tracker/CVE-2024-27305
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1276
ubuntu.com/security/CVE-2024-27305
cve.org/CVERecord?id=CVE-2024-27305
lists.opensuse.org/archives/list/[email protected]/thread/G642S3M3RN5DHIPCAJBHQAPH7Q6QWPX2
bugzilla.suse.com/1221328
suse.com/security/cve/CVE-2024-27305