Vulnerability · medium · CVSS 6.3
CPython imaplib STARTTLS plaintext buffering flaw (CVE-2026-115559)
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Python applications using imaplib with STARTTLS
Tier B because: Core infrastructure or popular tool AND remote, no login
Reach
Attack
Damage
Fix
Popular tool · Remote, no login
The Brief
- CPython's imaplib, when using STARTTLS, can serve plaintext bytes buffered before the TLS handshake as if they came over TLS.
- The flaw was announced on the oss-security list on 2026-11-10 as CVE-2026-115559.
Why it matters
Code that relies on imaplib STARTTLS may treat data an attacker injected before the handshake as authenticated TLS data, so developers should review their IMAP connections and apply a fixed CPython release once one is available.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Judgment: CPython's imaplib is a standard library module developers build and run mail tooling with. |
| No | Core infrastructure | Judgment: a single stdlib module in CPython is not foundational infrastructure like OpenSSH or glibc. |
| Yes | Popular tool | Judgment: CPython is a mainstream developer platform, and the flaw is in its shipped stdlib. |
| No | Exploited in the wild | Open Source Security: the advisory describes the flaw only; no observed attacks are reported. |
| No | Public exploit | Open Source Security: only an advisory is cited; no exploit code or PoC is mentioned. |
| Yes | Remote, no login | CVSSCVE-2026-115559: CVSS 6.3 – network, no privileges, no user interaction |
| No | Full takeover | CVSSCVSS: no CVE has both high confidentiality and integrity impact |
| No | Secrets exposed | Open Source Security: no source reports credentials or data actually stolen or exposed. |
| No | Supply chain | Open Source Security: a normal bug in legitimate code; no malicious code shipped is reported. |
| No | No fix yet | Open Source Security: the source does not say whether a patched version is available, so no is given. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-115559 ↗CVSS 6.3 medium AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS
- Exploited
- Not in CISA’s exploited catalog
Timeline
Flaw disclosed on the oss-security mailing list
Open Source Security
CPython: [CVE-2026-115559] imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS
Source
CPython: [CVE-2026-115559] imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS ↗ Open Source Security · 1h ago
First seen · 1 source · Full story page · How tiers are decided