Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP SMTP and POP3. When a server sends a \begin TLS\ response the client reads additional data (e.g. from a man-in-the-middle attacker) and evaluates it in a TLS context aka \response injection.\