CVE-2026-30227: MimeKit CRLF Injection Vulnerability Leading to SMTP Command Injection and Email Forgery
Summary
CVE-2026-30227: MimeKit has CRLF Injection in Quoted Local-Part that Enables SMTP Command Injection and Email Forgery. Affects MimeKit versions < 4.15.1. Fixed in 4.15.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MimeKit is a popular .NET library used for creating and parsing MIME messages, which are essential for email communication. It provides a robust framework for handling email messages, including support for various email protocols. However, a vulnerability in version 4.15.0 allows attackers to exploit the library by injecting CRLF sequences into the local-part of email addresses, leading to potential SMTP command injection and email forgery.
Vulnerability Detail
The vulnerability arises from a CRLF Injection flaw in MimeKit 4.15.0, which permits attackers to embed CRLF sequences into the quoted local-part of SMTP envelope addresses. This non-compliance with RFC 5321 can lead to SMTP command injection, allowing attackers to manipulate email commands such as RCPT TO, DATA, or RSET. The issue is particularly dangerous as it can enable unauthorized email redirection, data exfiltration, and even header injection, depending on how the application utilizes MimeKit.
How To Fix
Latest published version: 4.18.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.15.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application validates and sanitizes all user inputs for email addresses. Specifically, reject any input containing CR or LF characters in the local-part of email addresses. Here is a sample code snippet to validate email addresses:
public bool IsValidEmail(string email)
{
return !email.Contains("\r") && !email.Contains("\n");
}
Conclusion
The CRLF injection vulnerability in MimeKit 4.15.0 poses significant risks for applications that rely on this library for email handling. It is crucial to update to version 4.15.1 or later to mitigate these risks. Additionally, implementing input validation can help protect against potential exploitation until an update can be applied.
See every vulnerability recorded for MimeKit →
FAQ
CRLF injection is a type of attack where an attacker injects CR (Carriage Return) and LF (Line Feed) characters into a command or data stream, potentially altering the intended behavior of the application.
If your application uses MimeKit 4.15.0 and accepts untrusted input for email addresses, it may be susceptible to SMTP command injection, allowing attackers to manipulate email transactions.
Consequences include unauthorized email redirection, data exfiltration, and the ability to inject malicious commands into the SMTP session, which can compromise email integrity.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your packages.config without needing to sign up.
If an immediate update is not possible, implement input validation to reject any email addresses containing CR or LF characters as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for MimeKit.
