{"id":"RUSTSEC-2026-0141","revision":"676f682e68cd4457aadeed8a85b02fc4","records":[{"revision":"676f682e68cd4457aadeed8a85b02fc4","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0141","aliases":["CVE-2026-46428","GHSA-4pj9-g833-qx53"],"title":"TLS hostname verification disabled when using Boring TLS backend","description":"An inverted-boolean bug in lettre's `boring-tls` integration silently\ndisables TLS hostname verification for callers using the default (strict)\nconfiguration. An on-path attacker presenting any chain-valid certificate\nfor any domain can intercept SMTP submission, including PLAIN/LOGIN\ncredentials and message contents, against any lettre user built with the\n`boring-tls` feature. Other TLS backends (`native-tls`, `rustls`) are\nunaffected.\n\nThe bug was introduced in v0.10.1 and persists through v0.11.21 (latest).","state":0,"publishedAt":"2026-05-14T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:14.0451695+00:00","affected":[{"ecosystem":"crates.io","name":"lettre","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.10.1"},{"kind":"fixed","version":"0.11.22"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N","score":null,"severity":null}],"references":["https://crates.io/crates/lettre","https://rustsec.org/advisories/RUSTSEC-2026-0141.html","https://github.com/lettre/lettre/commit/f5efffc88360dbdbfcef80f465e42d5bce68ca35"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0141","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0141","identifiers":["RUSTSEC-2026-0141","CVE-2026-46428","GHSA-4pj9-g833-qx53"]},"retained":false,"historicalAffected":[]}],"coverage":[]}