Vulnerability · Published Apr 24, 2026 · Assigned by GitHub_M
CVE-2026-41319MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade
Medium 6.5
In plain English
A medium-severity injection in MailKit from jstedfast. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
MailKit is a cross-platform mail client library built on top of MimeKit. A STARTTLS Response Injection vulnerability in versions prior to 4.16.0 allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in `SmtpStream`, `ImapStream`, and `Pop3Stream` is not flushed when the underlying stream is replaced with `SslStream` during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. Version 4.16.0 patches the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | mailkit | 4.16.0 | GHSA-9j88-vvj5-vhgr |
Affected products (as reported)
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References
- https://github.com/jstedfast/MailKit/security/advisories/GHSA-9j88-vvj5-vhgr x_refsource_CONFIRM