SecurityFan score 43 · Tier B
CPython: [CVE-2026-115559] imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS
The Brief
- CPython's imaplib, when using STARTTLS, can serve plaintext bytes buffered before the TLS handshake as if they came over TLS.
- The flaw was announced on the oss-security list on 2026-11-10 as CVE-2026-115559.
Why it matters
Code that relies on imaplib STARTTLS may treat data an attacker injected before the handshake as authenticated TLS data, so developers should review their IMAP connections and apply a fixed CPython release once one is available.
Who’s affected
- Python applications using imaplib with STARTTLS
- CVE-2026-115559
- #python
- #imap
- #tls
- #vulnerability
- #cve-2026-115559
Posted by Alan Coopersmith on Nov 10 -------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-115559] imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS Date: Tue, 10 Nov 2026 09:41:54 -0800 From: Jelle Zijlstra via…
Timeline
Flaw disclosed on the oss-security mailing list
Open Source Security
CPython: [CVE-2026-115559] imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS