CVE-2024-34083 - CVE House
Back to Database
Status published Medium CVE-2024-34083

STARTTLS unencrypted commands injection

Vulnerability Description

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-34083

Credits & Attribution

No credits recorded in the NVD database.

References

More from aio-libs

View All →
CVE-2025-69230
AIOHTTP Vulnerable to Cookie Parser Warning Storm
Low 2.7
CVE-2025-69229
AIOHTTP vulnerable to DoS through chunked messages
Medium 6.6
CVE-2025-69228
AIOHTTP vulnerable to denial of service through large payloads
Medium 6.6
CVE-2025-69227
AIOHTTP vulnerable to DoS when bypassing asserts
Medium 6.6
CVE-2025-69226
AIOHTTP allows for a brute-force leak of internal static filepath components
Medium 6.3

Affected Vendor

Affected Software

aiosmtpd
Vulnerable Versions:
< 1.4.6

Timeline

Official Publish: May 18th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-349

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.