Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

mimekit

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.9NuGetPublished

    MimeKit has CRLF Injection in Quoted Local-Part that Enables SMTP Command Injection and Email Forgery

    CVE-2026-30227 · GHSA-g7hc-96xr-gvvx

    Affected
    • NuGet mimekit <= 4.15.0
    Fixed in
    4.15.1· Vendor fix available
    Issue
    A CRLF Injection vulnerability in MimeKit 4.15.0 allows an attacker to embed \r\n into the SMTP envelope address local-part (when the local-part is a quoted-string). This is non-compliant with RFC 5321 and can result in SMTP command injection (e.g., injecting additional RCPT TO / DATA / RSET commands) and/or mail header injection, depending on how the application uses MailKit/MimeKit to construct and send messages. The issue becomes exploitable when the attacker can influence a MailboxAddress (MAIL FROM / RCPT TO) value that is later serialized to an SMTP session. RFC 5321 explicitly defines the SMTP mailbox local-part grammar and does not permit CR (13) or LF (10) inside Quoted-string (qtextSMTP and quoted-pairSMTP ranges exclude control characters). SMTP commands are terminated by <CRLF, making CRLF injection in command arguments particularly dangerous. Details 1) RFC 5321 local-part grammar prohibits CR/LF in quoted-string RFC 5321 defines: When the local part is a quoted…

    Recommended action: Upgrade to 4.15.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 8.7NuGetPublished

    Mimekit has vulnerable dependency that can lead to denial of service

    GHSA-gmc6-fwg3-75m5

    Affected
    • NuGet mimekit >= 3.0.0, < 4.7.1
    Fixed in
    4.7.1· Vendor fix available
    Issue
    Denial of service vulnerability. Details See: https://github.com/advisories/GHSA-447r-wph3-92pm and https://github.com/dotnet/announcements/issues/312 PoC Update System.Security.Cryptography.Pkcs to 8.0.1 so that the transitive dependency with the issue gets updated Impact Denial of service vulnerability. Affects MimeKit (= v3.0.0 and <= v4.7.0) when used to decrypt or verify incoming S/MIME messages as well as importing 3rd-party X.509 certificates for use with encrypting outgoing S/MIME messages.

    Recommended action: Upgrade to 4.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →