AIKIDO-2026-861989

TL;DR

ImapFlow upgrades plaintext IMAP connections to TLS with the STARTTLS command, but before the fix it does not verify that the server stayed silent between the tagged STARTTLS OK and the TLS handshake. A man-in-the-middle can inject plaintext IMAP data right after the OK, and those buffered bytes are then processed as if they had arrived inside the established TLS session. This lets an attacker smuggle forged, trusted server responses into an otherwise encrypted session. The fix detects trailing data through a per-command parser flag and a post-unpipe socket read, failing closed with a STARTTLS_INJECTION error before wrapping the socket.