These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The aiosmtplib library before version 5.1.3 is vulnerable to ESMTP parameter injection via unvalidated email addresses. This allows attackers to inject parameters into MAIL FROM and RCPT TO command lines, potentially leading to forged authenticated identities or forced delivery notifications to third parties. The vulnerability can be exploited by crafting malicious addresses containing spaces and angle br [truncated]
This CVE debrief is based on the supplied source corpus for CVE-2026-55558, which involves a vulnerability in the aiosmtplib library. The vulnerability occurs in the SMTPProtocol.start_tls method, where an attacker can inject malicious SMTP response lines after the 220 response, leading to desynchronized SMTP command and response pairs. This issue affects connections using start_tls=True or opportunistic [truncated]
This PatchSiren debrief is based on the supplied CVE record and source item. The CVE record was published on 2026-08-18T18:18:20.513Z and has not been modified since then. The NVD entry is currently Deferred. The aiosmtplib library, used for asynchronous SMTP clients, had a vulnerability prior to version 5.1.1 where SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn() did not reject embedded CR or LF by [truncated]