STARTTLS Response Injection Vulnerability in MailKit by Jstedfast

CVE-2026-41319

What is CVE-2026-41319?

MailKit, a versatile mail client library developed by Jstedfast, suffers from a notable STARTTLS Response Injection vulnerability in versions prior to 4.16.0. This flaw allows attackers to exploit the plaintext-to-TLS transition by injecting arbitrary protocol responses. Consequently, a Man-in-the-Middle attacker can force a downgrade of the SASL authentication mechanisms, potentially compromising secure credentials. The vulnerability arises from the failure to flush the internal read buffer when the stream is converted to SSL during the STARTTLS upgrade, thereby treating malicious pre-TLS data as if it were trustworthy post-TLS responses. This issue has been addressed in version 4.16.0, which is recommended for all users to mitigate the risk.

References