{"id":"EUVD-2026-25388","enisaUuid":"f3169309-c75c-36b9-bc35-94f189d01496","description":"MailKit is a cross-platform mail client library built on top of MimeKit. A STARTTLS Response Injection vulnerability in versions prior to 4.16.0 allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in `SmtpStream`, `ImapStream`, and `Pop3Stream` is not flushed when the underlying stream is replaced with `SslStream` during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. Version 4.16.0 patches the issue.","datePublished":"Apr 24, 2026, 3:07:24 AM","dateUpdated":"Apr 25, 2026, 1:46:35 AM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/jstedfast/MailKit/security/advisories/GHSA-9j88-vvj5-vhgr\n","aliases":"CVE-2026-41319\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"63857ee7-5327-3de8-a918-0df29dd60849","product":{"name":"MailKit","vendor":{"name":"jstedfast"}},"product_version":"\u003c 4.16.0"}],"enisaIdVendor":[{"id":"08ee56dc-ee82-3dfa-8346-5464e6a9444f","vendor":{"name":"jstedfast"}}],"enisaIdVulnerability":[{"id":"4a61f981-61a7-31db-a847-8e6d482e7e57","vulnerability":{"id":"CVE-2026-41319","description":"MailKit is a cross-platform mail client library built on top of MimeKit. A STARTTLS Response Injection vulnerability in versions prior to 4.16.0 allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in `SmtpStream`, `ImapStream`, and `Pop3Stream` is not flushed when the underlying stream is replaced with `SslStream` during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. Version 4.16.0 patches the issue.","datePublished":"Apr 24, 2026, 3:07:24 AM","dateUpdated":"Apr 25, 2026, 1:46:35 AM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/jstedfast/MailKit/security/advisories/GHSA-9j88-vvj5-vhgr\n","enisa_id":"EUVD-2026-25388\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Nov 1, 2026, 7:18:11 AM","vulnerabilityProduct":[{"id":"e0ce6f04-57d8-3fa1-b3b6-0a573d090bed","product":{"name":"MailKit","vendor":{"name":"jstedfast"}},"product_version":"\u003c 4.16.0"}],"vulnerabilityVendor":[{"id":"572f7050-0048-383b-b09f-4c297ada1139","vendor":{"name":"jstedfast"}}]}}],"enisaIdAdvisory":[]}