aiosmtpd vulnerable to SMTP smuggling
Summary
aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue also existed in other SMTP software like Postfix (https://www.postfix.org/smtp-smuggling.html).
Details
Detailed information on SMTP smuggling can be found in the full blog post (https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/) or on the Postfix homepage (https://www.postfix.org/smtp-smuggling.html). (and soon on the official website https://smtpsmuggling.com/)
Impact
With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | aiosmtpd | < 1.4.5 | 1.4.5 |
References
- https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-pr2m-px7j-xg65
- https://github.com/aio-libs/aiosmtpd/commit/24b6c79c8921cf1800e27ca144f4f37023982bbb
- https://www.postfix.org/smtp-smuggling.html
- https://github.com/advisories/GHSA-pr2m-px7j-xg65
- https://nvd.nist.gov/vuln/detail/CVE-2024-27305
- https://github.com/aio-libs/aiosmtpd
- https://github.com/pypa/advisory-database/tree/main/vulns/aiosmtpd/PYSEC-2024-221.yaml
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N- Weakness (CWE)
CWE-345- Platform
- Python (PyPI)
- Package
aiosmtpd- Disclosed
- 12.03.2024
- Updated
- 11.10.2026 12:20
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2024-221 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-pr2m-px7j-xg65 - CC BY 4.0
Vulnerability history: aiosmtpd
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 03.2024 05.2024
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 2
Disclosures per year
- 2024: 2
- 2025: 0
- 2026: 0
-
aiosmtpd vulnerable to SMTP smuggling this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.