Executive brief
MailKit is a widely used library for sending and receiving emails in .NET applications. A security flaw allows an attacker positioned on the network to intercept and manipulate the initial connection between the application and the mail server. This could allow the attacker to trick the application into using less secure login methods, potentially exposing user credentials or sensitive communication.
Technical details
A STARTTLS Response Injection vulnerability exists in MailKit's SmtpStream, ImapStream, and Pop3Stream components. The root cause is that the internal read buffer is not flushed when the underlying stream is replaced with an SslStream during the STARTTLS upgrade. A Man-in-the-Middle (MitM) attacker can append malicious protocol responses (such as a downgraded SASL AUTH list) to the plaintext '220 Ready' response. Because the buffer is not cleared, MailKit processes this injected, unencrypted data as if it were trusted data received over the encrypted TLS connection. This allows an attacker to force the client to use insecure authentication mechanisms like PLAIN instead of SCRAM-SHA-256. The issue is resolved in version 4.16.0.
Affected products
- jstedfast MailKit < 4.16.0
Timeline
- 2026-04-17: advisory: GitHub Security Advisory published by maintainer
- 2026-04-24: disclosed: CVE published to NVD
- 2026-04-24: patched: Version 4.16.0 released