Cloudanix VulnDB

GHSA-9j88-vvj5-vhgr

Medium · 6.5

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

CVSS

6.5

EPSS

—

Published

Apr 18, 2026

CISA due date

—

The record

A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in `SmtpStream`, `ImapStream`, and `Pop3Stream` is not flushed when the underlying stream is replaced with `SslStream` during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities