CVE-2026-53533

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53533
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53533.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53533
Aliases
Downstream
Related
Published
2026-08-18T17:54:23Z
Modified
2026-08-21T03:30:30Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:H/SA:N CVSS Calculator
Summary
aiosmtplib: SMTP command injection via CR/LF in sender/recipient address
Details

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn() send caller-supplied addresses without rejecting embedded CR or LF bytes. Data after the line break is framed as additional standalone SMTP command lines, allowing an attacker who influences an envelope sender or recipient to inject commands such as MAIL FROM, RCPT TO, RSET, DATA, or AUTH. SMTP.sendmail() and SMTP.send() without a Message object pass addresses through the affected methods, while SMTP.send_message() is not affected. Successful injection can desynchronize the command-response pipeline, hang the SMTP instance, or send an arbitrary message without requiring attacker control of the SMTP server. This issue is fixed in version 5.1.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-77",
        "CWE-93"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53533.json"
}
References

Affected packages

Git / github.com/cole/aiosmtplib

Affected ranges

Type
GIT
Repo
https://github.com/cole/aiosmtplib
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8eaf6efc9a8f59e2e09d3ef11246a058c46bd3ba
Fixed
b18d293c3f03debe40f572bb20647fc3596b9af5
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.1.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.1.0
v1.1.0b0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.5.dev0
v1.1.6
v1.1.7
v2.*
v2.0.0
v2.0.0.post0
v2.0.0b0
v2.0.0b1
v2.0.1
v3.*
v3.0.0
v3.0.1
v3.0.2
v4.*
v4.0.0
v4.0.1
v4.0.2
v5.*
v5.0.0
v5.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53533.json"