CPython imaplib: Command injection via buffered plaintext after STARTTLS
Summary
The imaplib module in CPython keeps plaintext bytes received in the same network read as the STARTTLS OK response and returns them after the TLS handshake as if they came over the protected channel. A network attacker who cannot break TLS can append forged lines after the server's OK, so the client accepts a forged CAPABILITY response or a forged tagged completion of its next command. The attack requires an on-path position between the client and the IMAP server and affects the client, not the server.
Affected
- CPython 0 to before 3.16.0 (per CVE record)
- Exact affected maintenance branches: Unknown.
Fixed in
- Fix in CPython 3.16.0 (expected, per CVE record); fix is PR #160370.
- Backports to maintenance branches: Unknown. Check the PSF security announcement.
Workaround
- Use implicit TLS (IMAP4_SSL, port 993) instead of STARTTLS on port 143 until patched.
- Keep certificate validation enabled with a proper SSL context.
Exploitation
- No known exploitation in the wild.
- No CISA KEV listing and no public proof of concept known.
- The fix diff is public, so n-day exploitation is easier.
Our recommendation
- Inventory Python scripts and applications that use imaplib with starttls().
- Upgrade to the first Python release containing the fix once the PSF announcement confirms the fixed versions.
- Move to IMAPS (port 993) where possible in the meantime.
- Keep certificate validation enabled.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-115559 www.cve.org
- GitHub Issue #160369 github.com
- GitHub Pull Request #160370 (fix) github.com
- PSF security-announce thread mail.python.org
- imaplib source (main branch) github.com
- Certificate verification in Python mail libraries (Pentagrid) www.pentagrid.ch
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:57.
Original description (NVD)
IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv() as the tagged OK to STARTTLS are returned by readline() after the handshake, so the client treats them as the first responses on the protected channel. A network attacker who cannot break TLS can append forged lines after the server's OK, let the handshake complete with the real server and a valid certificate, and have the client accept the forged CAPABILITY and the forged tagged completion of the next command. This is the STARTTLS command/response injection class of CVE-2011-0411.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.