# CPython: [CVE-2026-115559] imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/649) · 2026-11-10 · Security
Page: https://themorning.dev/story/cpython-cve-2026-115559-imaplib-starttls-serves-plaintext-bytes-buffered-before-1c3edae4874c09a6
Kind: security · Impact: medium

## In brief

- CPython's imaplib, when using STARTTLS, can serve plaintext bytes buffered before the TLS handshake as if they came over TLS.
- The flaw was announced on the oss-security list on 2026-11-10 as CVE-2026-115559.

## Why it matters

Code that relies on imaplib STARTTLS may treat data an attacker injected before the handshake as authenticated TLS data, so developers should review their IMAP connections and apply a fixed CPython release once one is available.

## CVEs

- CVE-2026-115559

## Timeline

- 2026-11-10: Flaw disclosed on the oss-security mailing list

## Coverage

- [CPython: [CVE-2026-115559] imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS](https://seclists.org/oss-sec/2026/q4/649) — Open Source Security, 2026-11-10

Tags: python, imap, tls, vulnerability, cve-2026-115559

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev