CVE-2026-41319— MailKit 注入漏洞

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

MailKit is a cross-platform mail client library built on top of MimeKit. A STARTTLS Response Injection vulnerability in versions prior to 4.16.0 allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in `SmtpStream`, `ImapStream`, and `Pop3Stream` is not flushed when the underlying stream is replaced with `SslStream` during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. Version 4.16.0 patches the issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

输出中的特殊元素转义处理不恰当(注入)

MailKit 注入漏洞

MailKit是Jeffrey Stedfast个人开发者的一款跨平台邮件客户端库。 MailKit 4.16.0之前版本存在注入漏洞，该漏洞源于STARTTLS响应注入，可能导致中间人攻击者注入任意协议响应，实现SASL认证机制降级。

N/A

N/A