AIKIDO-2026-95892

TL;DR

When a connection is upgraded with STARTTLS, the client reads the server's 220 go-ahead reply and begins the TLS handshake without discarding bytes already sitting in the receive buffer. Because the asyncio transport is swapped in place while the protocol buffer is reused, plaintext read before the handshake survives into the encrypted session and is parsed as the first post-TLS server response. An active man-in-the-middle can pre-stage response lines right after the 220 reply to inject server responses and desynchronize every later command and response pair inside the supposedly encrypted session. The fix discards any data buffered after the 220 STARTTLS reply before performing the handshake, as required by RFC 3207.