CVE-2026-30227
CRLF Injection in MimeKit SMTP Envelope Enables Command Injection
Publication date: 2026-03-06
Last updated on: 2026-03-12
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jstedfast | mimekit | to 4.15.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-93 | The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-30227 is a CRLF injection vulnerability in MimeKit versions prior to 4.15.1. MimeKit is a C# library used for creating and parsing MIME messages. The vulnerability occurs because MimeKit improperly allows carriage return (CR) and line feed (LF) characters inside the quoted local-part of an SMTP envelope address (MAIL FROM or RCPT TO), which violates RFC 5321.
RFC 5321 forbids CR and LF characters within the quoted-string of the local-part because SMTP commands are terminated by CRLF sequences. Injecting CRLF into these command arguments can allow an attacker to inject additional SMTP commands such as RCPT TO, DATA, or RSET.
This vulnerability becomes exploitable when an attacker can influence the mailbox address used in the SMTP session, allowing them to inject arbitrary SMTP commands and potentially manipulate the SMTP transaction.
How can this vulnerability impact me? :
This vulnerability can lead to SMTP command injection, allowing an attacker to add or modify SMTP recipients, manipulate SMTP transactions, or inject early DATA commands.
Potential impacts include email forgery, mail redirection, data exfiltration, corruption of SMTP transaction state, and possible mail header injection depending on how the application uses MimeKit/MailKit.
Additionally, attackers may evade or mislead logging and auditing by altering SMTP transcripts, which can complicate incident detection and response.
The vulnerability affects any application using MimeKit/MailKit to send emails over SMTP where mailbox addresses can be influenced by untrusted input, such as user-supplied addresses or tenant-configurable identities.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring SMTP sessions for injected CRLF sequences within the local-part of envelope addresses (MAIL FROM or RCPT TO) that violate RFC 5321. Specifically, look for SMTP envelope addresses containing carriage return (CR, ASCII 13) and line feed (LF, ASCII 10) characters embedded inside quoted local-parts.'}, {'type': 'paragraph', 'content': 'One approach is to capture SMTP traffic using network packet capture tools or SMTP protocol logging features and search for suspicious mailbox addresses that include \\r\\n sequences within quoted strings.'}, {'type': 'paragraph', 'content': 'Example commands to detect such injection attempts include:'}, {'type': 'list_item', 'content': 'Using tcpdump or tshark to capture SMTP traffic and filter for suspicious patterns:'}, {'type': 'list_item', 'content': 'tcpdump -i <interface> -A port 25 | grep -P \'".*\\r\\n.*"\''}, {'type': 'list_item', 'content': 'tshark -i <interface> -Y \'smtp.req.parameter contains "\\r\\n"\' -T fields -e smtp.req.parameter'}, {'type': 'list_item', 'content': "Using application-level SMTP protocol logging (e.g., MailKit's ProtocolLogger) to capture SMTP sessions and inspect for injected commands or unexpected CRLF sequences in envelope addresses."}] [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade MimeKit and MailKit to version 4.15.1 or later, where this CRLF injection vulnerability has been patched.
Additionally, ensure that any application using MimeKit/MailKit properly validates and sanitizes mailbox addresses, rejecting any that contain carriage return (CR) or line feed (LF) characters in the local-part, especially within quoted strings, to comply with RFC 5321.
If upgrading immediately is not possible, consider implementing input validation or filtering on user-supplied email addresses to block CR and LF characters before they reach the SMTP sending component.