PT-2026-34845 · Mailkit · Emailkit

Rocmertakdag · Published 2026-04-18 · Updated 2026-05-21 · CVE-2026-41319

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions MailKit versions prior to 4.16.0

Description A STARTTLS Response Injection issue allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary. This can enable a SASL authentication mechanism downgrade, such as forcing the use of PLAIN instead of SCRAM-SHA-256. The issue occurs because the internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not flushed when the underlying stream is replaced with SslStream during a STARTTLS upgrade, leading to pre-TLS attacker-injected data being processed as trusted post-TLS responses.

Recommendations Update to version 4.16.0.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2026-41319

GHSA-9J88-VVJ5-VHGR

Affected Products

Emailkit

References · 7

• 🔥 https://github.com/jstedfast/MailKit/security/advisories/GHSA-9j88-vvj5-vhgr · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41319 · Security Note
• https://osv.dev/vulnerability/GHSA-9j88-vvj5-vhgr · Vendor Advisory
• https://github.com/jstedfast/MailKit · Note
• https://twitter.com/CVEnew/status/2048099324584693786 · Twitter Post
• https://t.me/cveNotify/164432 · Telegram Post
• https://t.me/cveNotify/164454 · Telegram Post