MimeKit is a widely used C# library for creating and parsing MIME messages according to IETF standards. Prior to version 4.15.1, MimeKit contained a CRLF injection vulnerability (CWE-93) identified as CVE-2026-30227. The vulnerability arises because MimeKit improperly neutralizes CRLF sequences in the SMTP envelope address local-part when it is formatted as a quoted-string. According to RFC 5321, the local-part of an SMTP mailbox must not contain carriage return (CR, ASCII 13) or line feed (LF, ASCII 10) characters, as SMTP commands are delimited by CRLF sequences. By injecting these characters, an attacker can manipulate the SMTP session by injecting additional SMTP commands such as RCPT TO, DATA, or RSET. This can lead to unauthorized mail delivery commands or mail header injection, potentially allowing spoofing or disruption of mail flow. Exploitation requires the attacker to influence the MailboxAddress value that MimeKit serializes during SMTP communication. The vulnerability does not require authentication or user interaction and can be exploited remotely over the network. The issue was addressed and fixed in MimeKit version 4.15.1 by properly sanitizing and rejecting CRLF sequences in the local-part of mailbox addresses. No known exploits are reported in the wild as of now.

The vulnerability can allow attackers to inject arbitrary SMTP commands into the mail transmission process, potentially enabling unauthorized mail delivery, mail spoofing, or disruption of mail services. This can undermine the integrity and reliability of email communications for organizations using vulnerable MimeKit versions. Attackers could manipulate recipient addresses or mail content, leading to phishing, spam propagation, or denial of service by resetting SMTP sessions. Since MimeKit is used in various mail-related applications and services, the impact can extend to any organization relying on these for email processing, including enterprises, service providers, and software vendors. The medium severity rating reflects the significant but not critical risk, given the lack of authentication requirements and the potential for remote exploitation. However, the scope depends on the extent to which vulnerable versions are deployed in production environments.

Organizations should immediately upgrade MimeKit to version 4.15.1 or later, where the vulnerability is patched. Developers using MimeKit should audit their code to ensure that any user-controllable input used in MailboxAddress fields is properly validated and sanitized to prevent injection of CRLF characters. Implement strict input validation on email address fields, rejecting any input containing control characters or non-compliant syntax per RFC 5321. Employ application-layer filters or SMTP proxies that can detect and block anomalous SMTP command sequences indicative of injection attempts. Conduct thorough testing of email handling workflows to verify that injected commands cannot be executed. Monitor email logs for unusual SMTP commands or session resets that may indicate exploitation attempts. Finally, maintain awareness of MimeKit updates and security advisories to promptly address future vulnerabilities.