---
id: "CVE-2026-115559"
page: "https://infrastack.ai/live/CVE-2026-115559"
kind: "vulnerability"
aliases: ["CVE-2026-115559"]
title: "Python imaplib: STARTTLS accepts plaintext bytes sent before the TLS handshake"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["email-clients", "imaplib", "python", "runtime"]
not_affected_if: ["implicit-tls", "no-starttls", "trusted-network"]
published_at: "2026-11-10T19:19:11+00:00"
first_seen_at: "2026-11-10T19:24:44+00:00"
updated_at: "2026-11-10T19:58:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115559", "first_seen_at": "2026-11-10T19:24:44+00:00"}]
exploit_sources: []
---

# Python imaplib: STARTTLS accepts plaintext bytes sent before the TLS handshake

Link for people: https://infrastack.ai/live/CVE-2026-115559 (this .md is for agents)

Python's imaplib keeps a read-ahead buffer that is not cleared when STARTTLS upgrades the connection, so plaintext lines the server sent before the handshake are treated as trusted TLS responses. A network attacker who can sit on the connection can inject forged IMAP responses, such as a fake CAPABILITY list or a fake completion for the next command, while the TLS certificate still validates.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `python3 --version` and compare against the fixed versions below.
- Search your code for `starttls(` used on `imaplib.IMAP4` clients, since that is the affected path.

## Fix

- Python: unknown (the sources do not state a fixed version)

## Timeline

- 2026-11-10T19:24:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115559

## Documents

- [advisory] Python security-announce: [Security-announce][CVE-2026-115559] imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS https://mail.python.org/archives/list/security-announce@python.org/message/LVAGFOFG26QVXEM6VXXPRMMOZBHM4CVB/

## From the sources

IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv() as the tagged OK to STARTTLS are returned by readline() after the handshake, so the client treats them as the first responses on the protected channel. A network attacker who cannot break TLS can append forged lines after the server's OK, let the handshake complete with the real server and a valid certificate, and have the client accept the forged CAPABILITY and the forged tagged completion of the next command. This is the STARTTLS command/response injection class of CVE-2011-0411.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_