Upgrading MailKit 3 to 4
Breaking3.6.0 → 4.18.2Security4Platform2Deprecated1New14Changed42Fixed38Other2
BreakingUpgrade verdict
2 platform requirement changes and 4 security fixes.
In plain terms
- The library can now be used with the newest .NET release, .NET 10.
- This version no longer runs on .NET 6, which Microsoft no longer supports.
- After a connection is upgraded to SSL/TLS, leftover internal buffer data is now cleared, closing a potential security gap.
- MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade
Must act Top 5 of 7 that need code or config changes
Target frameworks requirement changed in 4.15.0: .NETFramework4.6.2, .NETFramework4.7, .NETFramework4.8, .NETStandard2.0, .NETStandard2.1, net6.0 → .NETFramework4.6.2, .NETFramework4.7, .NETFramework4.8, .NETStandard2.0, .NETStandard2.1, net10.0, net8.0.
What you must change
Security4
Fixes protocol streams to reset internal buffers after upgrading to SSL/TLS.
MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade
Moderate · CVSS 6.5Bumps MimeKit to 4.15.1 to prevent mailbox addresses containing CRLF sequences that could inject SMTP commands in SmtpClient.
MimeKitSmtpClientMAIL FROMRCPT TOBumps MimeKit dependency to 4.7.1 to fix a denial of service security issue in the System.Formats.Asn1 dependency.
MimeKitSystem.Formats.Asn1Platform2
Adds support for .NET 10.
Drops support for net6.0, whose Microsoft support ended Nov 12, 2024.
net6.0Deprecations to plan for
Deprecated1
Marks IMailService.SslCipherAlgorithm, SslCipherStrength, SslHashAlgorithm, SslHashStrength, SslKeyExchangeAlgorithm and SslKeyExchangeStrength as Obsolete in .NET 10 in favor of SslCipherSuite.
IMailService.SslCipherAlgorithmIMailService.SslCipherStrengthIMailService.SslHashAlgorithmIMailService.SslHashStrengthIMailService.SslKeyExchangeAlgorithmIMailService.SslKeyExchangeStrengthIMailService.SslCipherSuite