CVE-2026-41319 Details
Description
MailKit is a cross-platform mail client library built on top of MimeKit. A STARTTLS Response Injection vulnerability in versions prior to 4.16.0 allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in `SmtpStream`, `ImapStream`, and `Pop3Stream` is not flushed when the underlying stream is replaced with `SslStream` during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. Version 4.16.0 patches the issue.
A STARTTLS response injection vulnerability has been identified in MailKit versions prior to 4.16.0. This vulnerability allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary. As a result, it enables the attacker to downgrade the SASL authentication mechanism, for example, by forcing the use of PLAIN instead of SCRAM-SHA-256. The issue arises because the internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the stream is upgraded to SslStream during the STARTTLS process. This oversight causes pre-TLS attacker-injected data to be incorrectly processed as trusted post-TLS responses.
Users should upgrade to MailKit version 4.16.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jstedfast/MailKit/security/advisories/GHSA-9j88-vvj5-vhgr | CISA-ADP | ExploitVendor Advisory |
| https://github.com/jstedfast/MailKit/security/advisories/GHSA-9j88-vvj5-vhgr | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jstedfast mailkit | < 4.16.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | Reanalysis | [email protected] |
| May 21, 2026 | Initial Analysis | [email protected] |
| Apr 25, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | New CVE Received | [email protected] |