---
id: CVE-2024-34083
aliases:
  - GHSA-wgjv-9j3q-jhg8
  - PYSEC-2026-1111
title: aiosmtpd STARTTLS unencrypted commands injection
summary: aiosmtpd STARTTLS unencrypted commands injection
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
vendor: aiosmtpd
product: aiosmtpd
ecosystem: pip
affected:
  - aiosmtpd < 1.4.6
patched:
  - aiosmtpd 1.4.6
published: '2024-05-20'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-wgjv-9j3q-jhg8'
references:
  - url: >-
      https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-34083'
  - url: >-
      https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfda
  - url: 'https://github.com/aio-libs/aiosmtpd'
  - url: 'https://nostarttls.secvuln.info'
tags:
  - osv
  - pip
epss: 0.00228
epssPercentile: 0.13818
ingestedAt: '2026-07-08T18:25:53.628Z'
---

## Overview

### Summary
Servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a MitM attack.

### References
* [NO STARTTLS: Similar vulnerabilities discovered by previous researchers.](https://nostarttls.secvuln.info/)

## Affected packages

- `aiosmtpd < 1.4.6`

## Remediation

Upgrade to a patched release:

- `aiosmtpd 1.4.6`