---
id: CVE-2026-46428
aliases:
  - RUSTSEC-2026-0141
  - GHSA-4pj9-g833-qx53
title: TLS hostname verification disabled when using Boring TLS backend
summary: TLS hostname verification disabled when using Boring TLS backend
severity: none
vendor: lettre
product: lettre
ecosystem: rust
affected:
  - 'lettre >= 0.10.1, < 0.11.22'
patched:
  - lettre 0.11.22
published: '2026-05-14'
updated: '2026-07-21'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0141'
references:
  - url: 'https://crates.io/crates/lettre'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0141.html'
  - url: 'https://github.com/lettre/lettre/security/advisories/GHSA-4pj9-g833-qx53'
tags:
  - osv
  - rust
epss: 0.00319
epssPercentile: 0.25127
ingestedAt: '2026-07-21T19:04:59.960Z'
---

## Overview

An inverted-boolean bug in lettre's `boring-tls` integration silently
disables TLS hostname verification for callers using the default (strict)
configuration. An on-path attacker presenting any chain-valid certificate
for any domain can intercept SMTP submission, including PLAIN/LOGIN
credentials and message contents, against any lettre user built with the
`boring-tls` feature. Other TLS backends (`native-tls`, `rustls`) are
unaffected.

The bug was introduced in v0.10.1 and persists through v0.11.21 (latest).

## Affected packages

- `lettre >= 0.10.1, < 0.11.22`

## Remediation

Upgrade to a patched release:

- `lettre 0.11.22`