MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

published 2026-04-18 6 mo ago modified 2026-10-26 13 d ago also GHSA-9j88-vvj5-vhgr , EUVD-2026-25388

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits: 0; none known

MailKit is a cross-platform mail client library built on top of MimeKit. A STARTTLS Response Injection vulnerability in versions prior to 4.16.0 allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in `SmtpStream`, `ImapStream`, and `Pop3Stream` is not flushed when the underlying stream is replaced with `SslStream` during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. Version 4.16.0 patches the issue.

Patch / fix

fixed in 2

nuget MailKit 4.16.0
jstedfast mailkit 4.16.0

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 6 mo ago (2026-04-25)

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/jstedfast/MailKit/security/advisories/GHSA-9j88-vvj5-vhgr referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NVD	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
GitHub	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
nuget	MailKit	<4.16.0	4.16.0

Affected products

jstedfast MailKit

Classification

Weakness

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

github.com /jstedfast/MailKit/security/advisories/GHSA-9j88-vvj5-vhgr
exploit, web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2026-41319
advisory
github.com /jstedfast/MailKit
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary