https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T08:03:24.227974+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-5416 EUVD-2026-5416 2026-10-08T08:03:24.233544+00:00 EUVD-2026-5416 https://cve.radiocsirt.org/vuln/fkie_cve-2024-34083 fkie_cve-2024-34083 2026-10-08T08:03:24.233576+00:00

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

 https://cve.radiocsirt.org/vuln/ghsa-wgjv-9j3q-jhg8 GHSA-wgjv-9j3q-jhg8 — aiosmtpd STARTTLS unencrypted commands injection 2026-10-08T08:03:24.233606+00:00

Affected: PyPI: aiosmtpd

### Summary Servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a MitM attack.

### References * [NO STARTTLS: Similar vulnerabilities discovered by previous researchers.](https://nostarttls.secvuln.info/)

 https://cve.radiocsirt.org/vuln/oesa-2024-1695 OESA-2024-1695 — python-aiosmtpd security update 2026-10-08T08:03:24.233631+00:00

Affected: openEuler:22.03-LTS-SP1: python-aiosmtpd

This is a server for SMTP and related protocols, similar in utility to the standard library's smtpd.py module, but rewritten to be based on asyncio for Python 3. Security Fix(es): aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.(CVE-2024-34083)

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:0243-1 openSUSE-SU-2024:0243-1 — Security update for python-aiosmtpd 2026-10-08T08:03:24.233654+00:00

Security update for python-aiosmtpd

 https://cve.radiocsirt.org/vuln/pysec-2026-1111 PYSEC-2026-1111 — aiosmtpd STARTTLS unencrypted commands injection 2026-10-08T08:03:24.233670+00:00

Affected: PyPI: aiosmtpd

### Summary Servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a MitM attack.

### References * [NO STARTTLS: Similar vulnerabilities discovered by previous researchers.](https://nostarttls.secvuln.info/)

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-34083 UBUNTU-CVE-2024-34083 2026-10-08T08:03:24.233687+00:00

Affected: Ubuntu:18.04:LTS: python-aiosmtpd, Ubuntu:20.04:LTS: python-aiosmtpd, Ubuntu:22.04:LTS: python-aiosmtpd, Ubuntu:24.04:LTS: python-aiosmtpd, Ubuntu:25.10: python-aiosmtpd, Ubuntu:26.04:LTS: python-aiosmtpd

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.