CVE-2026-30227

CVE-2026-30227 is a CRLF injection vulnerability in MimeKit, a C# library for creating and parsing MIME messages, affecting versions prior to 4.15.1. This flaw allows an attacker to embed carriage return and line feed characters into the SMTP envelope address local-part, which violates RFC 5321. This can lead to SMTP command injection, such as injecting additional recipient or data commands, and/or mail header injection, if the application uses MailKit/MimeKit to construct and send messages with attacker-controlled MailboxAddress values. The vulnerability has a CVSSv4 score of 6.9 (Medium), indicating a network-based attack with low attack complexity and no required privileges or user interaction. The potential impact involves unauthorized modification of SMTP commands or email headers, but does not directly affect confidentiality, integrity, or availability of the system itself. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion is minimal, with only one mention observed, and there is no media coverage.