Hi,

The following vulnerability was published for aiosmtplib.

CVE-2026-90467[0]:
| aiosmtplib before 5.1.3 fails to properly validate email addresses
| supplied by callers, allowing attackers to inject ESMTP parameters
| into MAIL FROM and RCPT TO command lines. Attackers can craft
| malicious addresses containing spaces and angle brackets to append
| parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging
| authenticated identities or forcing delivery notifications to third
| parties.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-90467
https://www.cve.org/CVERecord?id=CVE-2026-90467
[1] https://github.com/cole/aiosmtplib/commit/2e1b210714974ccc9efd0d09a8f846cb9aeaaec2

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
aiosmtplib, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1147474@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Dale Richards <dale@dalerichards.net> (supplier of updated aiosmtplib package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 13 Sep 2026 11:29:18 +0000
Source: aiosmtplib
Built-For-Profiles: noudeb
Architecture: source
Version: 5.1.3-1
Distribution: unstable
Urgency: high
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Dale Richards <dale@dalerichards.net>
Closes: 1147474
Changes:
 aiosmtplib (5.1.3-1) unstable; urgency=high
 .
   [ Dale Richards ]
   * Team upload.
   * New upstream release 5.1.3.
     - Addresses supplied by the caller were insufficiently validated, so an
       address containing spaces and angle brackets could smuggle extra ESMTP
       parameters (AUTH, NOTIFY, ORCPT, ...) onto the MAIL FROM and RCPT TO
       command lines, forging an authenticated identity or directing delivery
       notifications to a third party (CVE-2026-90467) (Closes: #1147474).
   * d/control:
     - Bump debhelper compatibility level to 14; drop ${misc:Depends} from both
       binary packages, as dh_gencontrol now applies the relationship substvars
       automatically.
     - Drop Priority and Rules-Requires-Root, both now dpkg defaults.
   * d/salsa-ci.yml: Add Salsa CI configuration.
 .
   [ Jeroen Ploemen ]
   * Control: add Built-Using field to the documentation package.
   * d/source/options: remove, only sets extend-diff-ignore for obsolete
     egg-info dir.
Checksums-Sha1:
 c7dccc2e080a167e0e13a70f1d31e8a0c0a7f777 2448 aiosmtplib_5.1.3-1.dsc
 e434b3e4ec8f60083f741092a21e7506e1321e83 77328 aiosmtplib_5.1.3.orig.tar.gz
 c0ae538832b6dc6296ea731efef0e831d975ec4a 5372 aiosmtplib_5.1.3-1.debian.tar.xz
 3c852cf551b931d782d404a1e12805d6fdd8448e 9421 aiosmtplib_5.1.3-1_source.buildinfo
Checksums-Sha256:
 c311f1534a5449cd1bd3975eae1d0091df3048481c23097e390f13d614711aac 2448 aiosmtplib_5.1.3-1.dsc
 80969634505ffe58dc3808e3f7b4d6e99119867596c789d71633eeabffac4de1 77328 aiosmtplib_5.1.3.orig.tar.gz
 70552c8594d636eb63418f0658668f45d804cceccc3b1b33063710b4ffad0aeb 5372 aiosmtplib_5.1.3-1.debian.tar.xz
 4095a02893a1ae5cb832f10957286c2c814d16e40261f1629e7420293381c68a 9421 aiosmtplib_5.1.3-1_source.buildinfo
Files:
 a50524a4acc56db868b997f32a7ba9a2 2448 python - aiosmtplib_5.1.3-1.dsc
 c29ea8a33faf5a138057fba97f7f5ed3 77328 python - aiosmtplib_5.1.3.orig.tar.gz
 f4b37e0b0194eac815a01034c45fd225 5372 python - aiosmtplib_5.1.3-1.debian.tar.xz
 40d1a8e35aeb9b8b2808cd1b1f940f58 9421 python - aiosmtplib_5.1.3-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEd8lhnEnWos3N8v+qQoMEoXSNzHoFAmqmiSkACgkQQoMEoXSN
zHo0dg/7BQI0a5rdCTz6A+LC7kem0lV8PRlCptiAUIdpq57tjO9LENGCdK11EJiv
BDADaaniLZoBNKeLJAw2vs2sqtItZSEoTmN4AtWfkmPjGhHaManoZ/xB/gfRwnYU
dMDtl5WTRYv3aUnHKDL6cwvk2P8kyeUmrU66YfOTcznp26dU/3Kvw02lfpcW8lZ2
Q9PXLVmP6Xg5obQTmZm5O1j2p3nQxP5qy5LRRYeQBFUusu23COgXH5vafmEb652f
yAJRPUa/FQ443DT3go/oN5SSFayLpv9Ak6MTOubtBenP3l1xUchEubngZL1/uGZK
GJzgJ6uJIL53LAUiHyMFiq8exylRIJm0Uz7VB2XW66ntiTSmpw8B2cyNl62zkY3p
Xl4Lxwq6RTBfyTF2QaUvZjk6UbNThs9LZcXeWVHHMiYP3cC3yHWOyX4cQ/HlaLRd
3dHxZsjXe0Y/luUTt6ZNnOZ9r0P+xDWKanHFHpvgiuy1deJCCuQkxmbJhghxnQ06
MouzUr6ZSI5sdNk37tuNHOXMhwAnhVJmtKF1Ud0en5aoWEzrIecYbEFRrf75vxd1
o38BPXVB2di5yJtVsJdZpT919gssDp1tMu6J75avfsbaG/O/fg0//xseC7Lrmjjw
5RN/KWdTYaSWXuT8PjBqU3QnOUoKEH44UHeP9YpQ4qPLRRQOFfg=
=FCru
-----END PGP SIGNATURE-----