Bug 2570879 (CVE-2026-115559)

Summary: CVE-2026-115559 python: python: Response injection in imaplib via unpurged buffer during STARTTLS
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: bbrownin, cahl, dfreiber, dkeler, drow, gbenhaim, jburrell, jlanda, kshier, ljawale, msilmser, niyer, rbobbitt, rhel-process-autobot, simaishi, stcannon, suppawar, thason, twaugh, vkumar, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Python's imaplib module. This vulnerability allows a network attacker to perform response injection on encrypted sessions. When upgrading an Internet Message Access Protocol (IMAP) connection using STARTTLS, the client fails to clear its internal buffer of unencrypted data received prior to encryption. A network attacker can inject forged responses alongside the server's upgrade confirmation, causing the client to treat the unauthenticated plaintext as valid data over the secured Transport Layer Security (TLS) connection.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-10 20:28:22 UTC 
IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv() as the tagged OK to STARTTLS are returned by readline() after the handshake, so the client treats them as the first responses on the protected channel. A network attacker who cannot break TLS can append forged lines after the server's OK, let the handshake complete with the real server and a valid certificate, and have the client accept the forged CAPABILITY and the forged tagged completion of the next command. This is the STARTTLS command/response injection class of CVE-2011-0411.