{"schema_version":"1.9.0","id":"RUSTSEC-2026-0141","published":"2026-05-14T12:00:00Z","modified":"2026-10-12T18:00:14.045169536Z","aliases":["CVE-2026-46428","GHSA-4pj9-g833-qx53"],"summary":"TLS hostname verification disabled when using Boring TLS backend","details":"An inverted-boolean bug in lettre's `boring-tls` integration silently\ndisables TLS hostname verification for callers using the default (strict)\nconfiguration. An on-path attacker presenting any chain-valid certificate\nfor any domain can intercept SMTP submission, including PLAIN/LOGIN\ncredentials and message contents, against any lettre user built with the\n`boring-tls` feature. Other TLS backends (`native-tls`, `rustls`) are\nunaffected.\n\nThe bug was introduced in v0.10.1 and persists through v0.11.21 (latest).","affected":[{"package":{"name":"lettre","ecosystem":"crates.io","purl":"pkg:cargo/lettre"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.10.1"},{"fixed":"0.11.22"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["crypto-failure"],"cvss":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0141.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/lettre"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0141.html"},{"type":"WEB","url":"https://github.com/lettre/lettre/commit/f5efffc88360dbdbfcef80f465e42d5bce68ca35"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N"}]}