Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

MailKit Library Allows Hackers to Interfere with Email Connections

CVE-2026-41319 · published 6 months ago
Summary

Older versions of the MailKit library can be tricked by hackers into accepting fake information during email connections. This could allow attackers to take control of your email account. Update to version 4.16.0 or later to fix this issue.

What to do
  • Update mimekit mailkit to version 4.16.0 or later.
Affected software
VendorProductAffected versions
mimekit mailkit < 4.16.0
cpe:2.3:a:mimekit:mailkit:*:*:*:*:*:*:*:*
Original advisory text
MailKit is a cross-platform mail client library built on top of MimeKit. A STARTTLS Response Injection vulnerability in versions prior to 4.16.0 allows a Man-in-the-Middle attacker to inject arbitr...
MailKit is a cross-platform mail client library built on top of MimeKit. A STARTTLS Response Injection vulnerability in versions prior to 4.16.0 allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in `SmtpStream`, `ImapStream`, and `Pop3Stream` is not flushed when the underlying stream is replaced with `SslStream` during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. Version 4.16.0 patches the issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-74Injection
Timeline
Published24 Apr 2026
Updated4 Nov 2026
First seen24 Apr 2026
Sources
CVE-2026-41319 · NVD
Track software like this
Free during beta