49 matches found
lettre has TLS hostname verification disabled when using Boring TLS backend
Summary An inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN...
EUVD-2026-45982
lettre has TLS hostname verification disabled when using Boring TLS backend...
GHSA-4PJ9-G833-QX53 lettre has TLS hostname verification disabled when using Boring TLS backend
Summary An inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN...
async-smtp-lite (>=0.1.0, <=0.1.2), br-email (>=0.1.2, <=1.0.9) +21 more potentially affected by CVE-2026-46428 via lettre (>=0.10.1, <=0.10.4)
lettre CARGO version =0.10.1, =0.1.0, =0.1.2, =1.6.4, =0.0.1, =0.1.0, =1.0.0, =0.1.0, =0.5.2, =0.0.1, =0.1.0, =3.0.0-alpha.8, =1.2.0, =1.4.3 - kagou 0.1.21 and more Source cves: CVE-2026-46428 Source advisory: GHSA-4PJ9-G833-QX53...
async-smtp-lite (>=0.1.0, <=0.1.2), br-email (>=0.1.2, <=1.0.9) +21 more potentially affected by CVE-2026-46428 via lettre (>=0.10.1, <=0.10.4)
lettre CARGO version =0.10.1, =0.1.0, =0.1.2, =1.6.4, =0.0.1, =0.1.0, =1.0.0, =0.1.0, =0.5.2, =0.0.1, =0.1.0, =3.0.0-alpha.8, =1.2.0, =1.4.3 - kagou 0.1.21 and more Source cves: CVE-2026-46428 Source advisory: OSV:GHSA-4PJ9-G833-QX53...
CVE-2026-46428
A flaw was found in lettre, a mailer library for Rust. An inverted-boolean bug in the boring-tls integration silently disables TLS hostname verification for users employing the default strict configuration. A remote on-path attacker can exploit this by presenting any valid TLS certificate, allowi...
CVE-2026-46428
lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...
CVE-2026-46428 lettre has TLS hostname verification disabled when using Boring TLS backend
lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...
CVE-2026-46428
lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...
CVE-2026-46428 lettre has TLS hostname verification disabled when using Boring TLS backend
lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...
CVE-2026-46428 lettre has TLS hostname verification disabled when using Boring TLS backend
lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...
CVE-2026-46428
CVE-2026-46428 affects the Rust mailer library lettre. Versions 0.10.1 through before 0.11.22 using the boring-tls backend have an inverted-boolean bug that silently disables TLS hostname verification under the default strict configuration. An on-path attacker presenting any chain-valid certifica...
CVE-2026-46428: Improper Certificate Validation
lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...
async-smtp-lite (>=0.1.0, <=0.1.2), br-email (>=0.1.2, <=1.0.9) +21 more potentially affected by CVE-2026-46428 via lettre (>=0.10.1, <=0.10.4)
lettre CARGO version =0.10.1, =0.1.0, =0.1.2, =1.6.4, =0.0.1, =0.1.0, =1.0.0, =0.1.0, =0.5.2, =0.0.1, =0.1.0, =3.0.0-alpha.8, =1.2.0, =1.4.3 - kagou 0.1.21 and more Source cves: CVE-2026-46428 Source advisory: OSV:RUSTSEC-2026-0141...
RUSTSEC-2026-0141 TLS hostname verification disabled when using Boring TLS backend
An inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN credentials and...
TLS hostname verification disabled when using Boring TLS backend
An inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN credentials and...
PT-2026-61618
Name of the Vulnerable Software and Affected Versions lettre versions 0.10.1 through 0.11.21 Description An inverted-boolean bug in the boring-tls integration silently disables TLS hostname verification for users employing the default strict configuration. This allows an on-path attacker with a...
EUVD-2021-1485
Malware in sbrugna...
EUVD-2021-1888
Malware in sbrugna...
CVE-2021-38189
An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two sequences and then inject arbitrary SMTP commands...