Description
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cole | aiosmtplib | < 5.1.3 | 5.1.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | aiosmtplib | 5.1.3-1 | — |
| Debian 13 | aiosmtplib | No fix yet | — |
| Debian 12 | aiosmtplib | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | aiosmtplib | No fix yet | — |
| Ubuntu 26.04 LTS | aiosmtplib | No fix yet | — |
| Ubuntu 22.04 LTS | aiosmtplib | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-aiosmtplib | 5.1.3-1.1 | openSUSE-SU-2026:11799-1 |
Advisories 1
- openSUSE-SU-2026:11799-1 python313-aiosmtplib-5.1.3-1.1 on GA media SUSE / openSUSE Security Updates · Sep 17, 2026
References
- Patch Commit patch
- aiosmtplib v5.1.3 Release Notes release-notes
- Unvalidated quote_address() in v5.1.2 technical-description
- https://github.com/cole/aiosmtplib product
- VulnCheck Advisory: aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses third-party-advisory