6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30227

CVE-2026-30227: MimeKit: CRLF Injection in Quoted Local-Part Enables SMTP Command Injection and Email Forgery

MimeKit is a C# library which may be used for the creation and parsing of messages using the Multipurpose Internet Mail Extension (MIME), as defined by numerous IETF specifications. Prior to version 4.15.1, a CRLF injection vulnerability in MimeKit allows an attacker to embed \r\n into the SMTP envelope address local-part (when the local-part is a quoted-string). This is non-compliant with RFC 5321 and can result in SMTP command injection (e.g., injecting additional RCPT TO / DATA / RSET commands) and/or mail header injection, depending on how the application uses MailKit/MimeKit to construct and send messages. The issue becomes exploitable when the attacker can influence a MailboxAddress (MAIL FROM / RCPT TO) value that is later serialized to an SMTP session. RFC 5321 explicitly defines the SMTP mailbox local-part grammar and does not permit CR (13) or LF (10) inside Quoted-string (qtextSMTP and quoted-pairSMTP ranges exclude control characters). SMTP commands are terminated by <CRLF>, making CRLF injection in command arguments particularly dangerous. This issue has been patched in version 4.15.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30227

CVE-2026-30227:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
MimeKit	nuget	<= 4.15.0	4.15.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a CRLF injection in MimeKit, occurring when an email address with a quoted local-part is parsed. An attacker can craft a malicious email address containing CRLF sequences (e.g., "local\r\npart"@domain.com).

When an application uses MimeKit to create a MailboxAddress object from this malicious string, for instance, via new MailboxAddress("name", maliciousAddress), the MimeKit parser incorrectly accepts the illegal CRLF characters. This can be abused to inject arbitrary SMTP commands.

The root cause of the vulnerability is located in the MimeKit.InternetAddress.TryParseLocalPart function. Before the patch, this function utilized a generic and overly permissive utility function, ParseUtils.SkipQuoted, for parsing quoted strings. This utility did not validate and reject control characters like Carriage Return (CR) and Line Feed (LF), which are explicitly forbidden within the local-part of an email address by RFC 5321.

The patch rectifies this issue by replacing the call to ParseUtils.SkipQuoted with a new, stricter SkipQuoted method implemented directly within the InternetAddress.cs file. This new method correctly validates the characters inside the quoted string and throws a ParseException upon encountering any control characters, thereby preventing the CRLF injection.

During exploitation, a runtime profiler would capture the call to the MailboxAddress constructor, which is the public API entry point, followed by the internal call to MimeKit.InternetAddress.TryParseLocalPart, where the flawed parsing logic resides. Consequently, both of these functions are critical indicators that the vulnerability is being triggered.

Vulnerable functions

MimeKit.InternetAddress.TryParseLocalPart

MimeKit/InternetAddress.cs

This internal function is responsible for parsing the local-part of an email address. The vulnerability lies in this function's use of the overly permissive `ParseUtils.SkipQuoted` method, which failed to reject illegal CRLF control characters within a quoted string. The patch replaces this call with a new, stricter `SkipQuoted` method that properly validates the input according to RFC specifications, thus mitigating the CRLF injection vulnerability.

MimeKit.MailboxAddress..ctor

MimeKit/MailboxAddress.cs

This is the public constructor for the `MailboxAddress` class and serves as the primary entry point for the vulnerability. An attacker supplies a malicious string containing CRLF sequences to this constructor. The constructor then invokes the vulnerable parsing logic internally. The patch evidence from the unit tests shows that this constructor is now expected to throw a `ParseException` when provided with an invalid address, whereas it would have parsed it successfully before.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.