MailKit, a cross-platform mail client library, suffers from a STARTTLS Response Injection vulnerability (CWE-74) in versions before 4.16.0. The vulnerability arises because the internal read buffer in SmtpStream, ImapStream, and Pop3Stream is not cleared when the underlying stream switches to SslStream during the STARTTLS upgrade. This allows a Man-in-the-Middle attacker to inject malicious protocol responses before TLS is established, which are then incorrectly treated as trusted responses after the upgrade. This can lead to SASL authentication mechanism downgrade attacks, such as forcing the use of less secure authentication methods like PLAIN instead of SCRAM-SHA-256. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity). Version 4.16.0 of MailKit addresses this issue.

An attacker positioned to intercept and modify traffic before the TLS upgrade can inject malicious protocol responses that are processed as trusted after the upgrade. This enables downgrade of SASL authentication mechanisms, potentially weakening authentication security and increasing the risk of credential exposure. There is no direct confidentiality impact reported, but integrity of the authentication negotiation is compromised.

Upgrade MailKit to version 4.16.0 or later, where this vulnerability is patched. Since the vendor advisory indicates the issue is fixed in 4.16.0, applying this official fix fully mitigates the vulnerability. No other mitigations are specifically indicated.