{"id":"CVE-2026-46428","aliases":["RUSTSEC-2026-0141","GHSA-4pj9-g833-qx53"],"title":"TLS hostname verification disabled when using Boring TLS backend","summary":"TLS hostname verification disabled when using Boring TLS backend","severity":"none","vendor":"lettre","product":"lettre","ecosystem":"rust","affected":["lettre >= 0.10.1, < 0.11.22"],"patched":["lettre 0.11.22"],"published":"2026-05-14","updated":"2026-07-21","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0141","references":[{"url":"https://crates.io/crates/lettre"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0141.html"},{"url":"https://github.com/lettre/lettre/security/advisories/GHSA-4pj9-g833-qx53"}],"tags":["osv","rust"],"epss":0.00319,"epssPercentile":0.25131,"ingestedAt":"2026-07-21T19:04:59.960Z","slug":"CVE-2026-46428","body":"## Overview\n\nAn inverted-boolean bug in lettre's `boring-tls` integration silently\ndisables TLS hostname verification for callers using the default (strict)\nconfiguration. An on-path attacker presenting any chain-valid certificate\nfor any domain can intercept SMTP submission, including PLAIN/LOGIN\ncredentials and message contents, against any lettre user built with the\n`boring-tls` feature. Other TLS backends (`native-tls`, `rustls`) are\nunaffected.\n\nThe bug was introduced in v0.10.1 and persists through v0.11.21 (latest).\n\n## Affected packages\n\n- `lettre >= 0.10.1, < 0.11.22`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `lettre 0.11.22`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}