Is CVE-2026-115559 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115559 being exploited in the wild.

How severe is CVE-2026-115559?

Informational severity, published 10 November 2026.

Which products and versions are affected?

Python Imaplib before patched releases.

How is CVE-2026-115559 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115559?

Check whether you run Python Imaplib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115559: Python imaplib STARTTLS command/response injection

CVE-2026-115559 · Severity: info · Published 2026-11-10

Python's imaplib module contains a vulnerability in the STARTTLS encryption upgrade mechanism that allows a network attacker to inject forged server responses after the TLS handshake completes. An attacker positioned on the network can append malicious commands to legitimate STARTTLS responses, causing the client to accept fake CAPABILITY announcements or false completion confirmations as if they came from the encrypted channel. This could lead to authentication bypass, email spoofing, or acceptance of unauthorized IMAP commands.

Vendors: Python.

Quick answers

Is CVE-2026-115559 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115559 being exploited in the wild.
How severe is CVE-2026-115559?: Informational severity, published 10 November 2026.
Which products and versions are affected?: Python Imaplib before patched releases.
Is there a fix for CVE-2026-115559?: Yes: fixed in Python 3.11, 3.12, 3.13, 3.14, 3.15 (patched via PR #160370). Until then: Reject any buffered plaintext data in the read-ahead buffer after STARTTLS response processing completes; discard both _readbuf and untagged_responses caches before upgrading the connection to TLS. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115559 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115559?: Check whether you run Python Imaplib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Python 3.11, 3.12, 3.13, 3.14, 3.15 (patched via PR #160370)

Reject any buffered plaintext data in the read-ahead buffer after STARTTLS response processing completes; discard both _readbuf and untagged_responses caches before upgrading the connection to TLS.

Technical details

The IMAP4.starttls() method wraps the socket connection in TLS but fails to discard the read-ahead buffer (self._readbuf) containing plaintext data already received before encryption was activated. An attacker can append forged lines after a legitimate server OK response to STARTTLS, and since the client processes buffered plaintext bytes after the handshake as if they were TLS-protected responses, the forged content is accepted. This is a STARTTLS command/response injection attack similar to CVE-2011-0411.

Affected products

Python imaplib before patched releases

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.