{"id":"CVE-2024-27305","aliases":["DEBIAN-CVE-2024-27305","EUVD-2024-0215","GHSA-pr2m-px7j-xg65","OESA-2024-1276","OESA-2024-1320","OESA-2024-1321","OESA-2024-1322","PYSEC-2024-221","UBUNTU-CVE-2024-27305","openSUSE-SU-2024:0243-1","openSUSE-SU-2024:13774-1","openSUSE-SU-2026:11675-1"],"status":"published","title":"SMTP smuggling in aiosmtpd","description":"aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00371,"percentile":0.31423,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-345"],"published":"2024-03-12T20:29:54Z","modified":"2026-11-02T12:02:30Z","fixes":[{"ecosystem":"PyPI","package":"aiosmtpd","fixed_in":["1.4.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-aiosmtpd","fixed_in":["1.4.3-1.1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-aiosmtpd","fixed_in":["1.4.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-aiosmtpd","fixed_in":["1.4.6-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"python-aiosmtpd","fixed_in":["1.4.2-2.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"python-aiosmtpd","fixed_in":["1.4.2-2.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"python-aiosmtpd","fixed_in":["1.4.2-2.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"python-aiosmtpd","fixed_in":["1.4.2-2.oe2203sp3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-1.1+deb12u1"}]}],"versions":["1.4.3-1.1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5"}]}],"versions":["1.0","1.0a1","1.0a2","1.0a3","1.0a4","1.0a5","1.0b1","1.0rc1","1.1","1.2","1.2.2","1.2.4","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.4.2","1.4.3","1.4.3rc1","1.4.3rc2","1.4.4","1.4.4.post1","1.4.4.post2"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"python-aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-2.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-2.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"python-aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-2.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"aiosmtpd","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"24b6c79c8921cf1800e27ca144f4f37023982bbb"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5"}]}],"versions":["1.0","1.0a1","1.0a2","1.0a3","1.0a4","1.0a5","1.0b1","1.0rc1","1.1","1.2","1.2.2","1.2.4","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.4.2","1.4.3","1.4.3rc1","1.4.3rc2","1.4.4","1.4.4.post1","1.4.4.post2","1.3.0a3","1.3.0a2","1.2.3","1.2.1","1.2-rc"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1-3","1.1-4","1.1-5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.2-1","1.4.2-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.3-1.1","1.4.4.post2-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.6-5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.6-6","1.4.6-7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.6-5","1.4.6-6"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"python-aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-bp155.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-bp155.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-aiosmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-6.1"}]}],"bundled":2}],"products":[{"vendor":"aio-libs","product":"aiosmtpd"}],"references":[{"url":"https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-pr2m-px7j-xg65","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/aio-libs/aiosmtpd/commit/24b6c79c8921cf1800e27ca144f4f37023982bbb","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://www.postfix.org/smtp-smuggling.html","tags":["x_refsource_MISC","x_transferred","Product","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27305","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiosmtpd/PYSEC-2024-221.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pr2m-px7j-xg65","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27305.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-27305","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiosmtpd","tags":["package"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1276","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1320","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1321","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1322","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-27305","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-27305","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G642S3M3RN5DHIPCAJBHQAPH7Q6QWPX2/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1221328","tags":["report"]},{"url":"https://bugzilla.suse.com/1224467","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34083","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-27305","title":"SMTP smuggling in aiosmtpd","description":"aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-12T20:29:54.592Z","modified":"2024-08-02T00:27:59.989Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:34:12.982241Z"}],"euvd":[{"id":"EUVD-2024-0215","description":"aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-12T20:29:54Z","modified":"2024-08-02T00:27:59Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:27.194572Z"}],"ghsa":[{"id":"GHSA-pr2m-px7j-xg65","title":"aiosmtpd vulnerable to SMTP smuggling","description":"### Summary\naiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue also existed in other SMTP software like Postfix (https://www.postfix.org/smtp-smuggling.html).\n\n### Details\nDetailed information on SMTP smuggling can be found in the full blog post (https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/) or on the Postfix homepage (https://www.postfix.org/smtp-smuggling.html). (and soon on the official website https://smtpsmuggling.com/)  \n\n### Impact\nWith the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances.","status":"published","published":"2024-03-13T15:33:14Z","modified":"2025-01-22T18:45:42Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:38:28.945236Z"}],"nvd":[{"id":"CVE-2024-27305","description":"aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-12T21:15:58.63Z","modified":"2026-06-17T07:19:36.81Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:09:40.831473Z"}],"osv":[{"id":"CVE-2024-27305","title":"SMTP smuggling in aiosmtpd","description":"aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-12T20:29:54.592Z","modified":"2026-10-28T02:30:35.9844196Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:44:39.569658Z"},{"id":"DEBIAN-CVE-2024-27305","description":"aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-12T21:15:58.63Z","modified":"2026-11-02T12:02:30.077186177Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:42.204259Z"},{"id":"GHSA-pr2m-px7j-xg65","title":"aiosmtpd vulnerable to SMTP smuggling","description":"### Summary\naiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue also existed in other SMTP software like Postfix (https://www.postfix.org/smtp-smuggling.html).\n\n### Details\nDetailed information on SMTP smuggling can be found in the full blog post (https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/) or on the Postfix homepage (https://www.postfix.org/smtp-smuggling.html). (and soon on the official website https://smtpsmuggling.com/)  \n\n### Impact\nWith the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances.","status":"published","published":"2024-03-13T15:33:14Z","modified":"2026-06-10T17:14:17.820156268Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"OESA-2024-1276","title":"python-aiosmtpd security update","description":"This is a server for SMTP and related protocols, similar in utility to the standard library\u0026apos;s smtpd.py module, but rewritten to be based on asyncio for Python 3.\r\n\r\nSecurity Fix(es):\r\n\r\naiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-27305)","status":"published","published":"2024-03-15T11:06:43Z","modified":"2026-08-18T01:18:18.419729001Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1320","title":"python-aiosmtpd security update","description":"This is a server for SMTP and related protocols, similar in utility to the standard library\u0026apos;s smtpd.py module, but rewritten to be based on asyncio for Python 3.\r\n\r\nSecurity Fix(es):\r\n\r\naiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-27305)","status":"published","published":"2024-03-22T11:06:46Z","modified":"2026-08-18T01:18:19.264585728Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1321","title":"python-aiosmtpd security update","description":"This is a server for SMTP and related protocols, similar in utility to the standard library\u0026apos;s smtpd.py module, but rewritten to be based on asyncio for Python 3.\r\n\r\nSecurity Fix(es):\r\n\r\naiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-27305)","status":"published","published":"2024-03-22T11:06:46Z","modified":"2026-08-18T01:18:19.295471798Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1322","title":"python-aiosmtpd security update","description":"This is a server for SMTP and related protocols, similar in utility to the standard library\u0026apos;s smtpd.py module, but rewritten to be based on asyncio for Python 3.\r\n\r\nSecurity Fix(es):\r\n\r\naiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-27305)","status":"published","published":"2024-03-22T11:06:46Z","modified":"2026-08-18T01:18:19.439643016Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"PYSEC-2024-221","description":"aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-12T21:15:58Z","modified":"2026-06-10T17:14:17.101220621Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:54.242332Z"},{"id":"UBUNTU-CVE-2024-27305","description":"aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-12T21:15:00Z","modified":"2026-10-17T12:56:43.905626406Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"openSUSE-SU-2024:0243-1","title":"Security update for python-aiosmtpd","description":"This update for python-aiosmtpd fixes the following issues:\n\n- CVE-2024-34083: Fixed MiTM attack could inject extra unencrypted commands after STARTTLS (boo#1224467)\n- CVE-2024-27305: Fixed SMTP smuggling (boo#1221328)\n","status":"published","published":"2024-08-16T04:02:47Z","modified":"2026-02-04T04:22:34.008704Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:13774-1","title":"python310-aiosmtpd-1.4.5-2.1 on GA media","description":"These are all security issues fixed in the python310-aiosmtpd-1.4.5-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:44.349563Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2026:11675-1","title":"python313-aiosmtpd-1.4.6-6.1 on GA media","description":"These are all security issues fixed in the python313-aiosmtpd-1.4.6-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-02T00:00:00Z","modified":"2026-09-03T10:00:09.523641028Z","updated_at":"2026-11-02T16:58:39.516824Z"}]}}