lettre has TLS hostname verification disabled when using Boring TLS backend

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-46428 · Microsoft / collected KEV context

EUVD-2026-45982

GHSA-4pj9-g833-qx53

RUSTSEC-2026-0141

cve-program · CVE-2026-46428

• https://github.com/lettre/lettre/security/advisories/GHSA-4pj9-g833-qx53
• https://github.com/lettre/lettre/commit/f5efffc88360dbdbfcef80f465e42d5bce68ca35
• https://github.com/lettre/lettre/releases/tag/v0.11.22
• https://rustsec.org/advisories/RUSTSEC-2026-0141.html

euvd · EUVD-2026-45982

• https://github.com/lettre/lettre/security/advisories/GHSA-4pj9-g833-qx53
• https://github.com/lettre/lettre/commit/f5efffc88360dbdbfcef80f465e42d5bce68ca35
• https://github.com/lettre/lettre/releases/tag/v0.11.22
• https://rustsec.org/advisories/RUSTSEC-2026-0141.html

nvd · CVE-2026-46428

• https://github.com/lettre/lettre/commit/f5efffc88360dbdbfcef80f465e42d5bce68ca35
• https://github.com/lettre/lettre/releases/tag/v0.11.22
• https://github.com/lettre/lettre/security/advisories/GHSA-4pj9-g833-qx53
• https://rustsec.org/advisories/RUSTSEC-2026-0141.html

osv · GHSA-4pj9-g833-qx53

• https://github.com/lettre/lettre/security/advisories/GHSA-4pj9-g833-qx53
• https://nvd.nist.gov/vuln/detail/CVE-2026-46428
• https://github.com/lettre/lettre/commit/f5efffc88360dbdbfcef80f465e42d5bce68ca35
• https://github.com/lettre/lettre
• https://github.com/lettre/lettre/releases/tag/v0.11.22
• https://rustsec.org/advisories/RUSTSEC-2026-0141.html

osv · RUSTSEC-2026-0141

• https://crates.io/crates/lettre
• https://rustsec.org/advisories/RUSTSEC-2026-0141.html
• https://github.com/lettre/lettre/commit/f5efffc88360dbdbfcef80f465e42d5bce68ca35

No related operational record is retained in the current change model.