What’s Vulnerable › Vulnerabilities

CVE-2024-27305: SMTP smuggling in aiosmtpd

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-12 · updated 2026-06-17
• Weakness: CWE-345

Description

aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• aio-libs aiosmtpd: before 1.4.5 — fixed in 1.4.5

How to fix

Upgrade to a fixed version: aio-libs aiosmtpd 1.4.5. Check the vendor advisory for mitigations.

References

• https://github.com/aio-libs/aiosmtpd/commit/24b6c79c8921cf1800e27ca144f4f37023982bbb
• https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-pr2m-px7j-xg65
• https://www.postfix.org/smtp-smuggling.html
• https://github.com/aio-libs/aiosmtpd/commit/24b6c79c8921cf1800e27ca144f4f37023982bbb
• https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-pr2m-px7j-xg65
• https://www.postfix.org/smtp-smuggling.html

Get alerted when CVE-2024-27305 or the next vulnerability affects your stack