GHSA-4PJ9-G833-QX53 lettre has TLS hostname verification disabled when using Boring TLS backend

Summary An inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN...

EUVD-2026-45982

lettre has TLS hostname verification disabled when using Boring TLS backend...

anansi (>=0.10.0, <=0.14.2), anansi-core (>=0.10.0, <=0.14.2) +76 more potentially affected by CVE-2026-46428 via lettre (>=0.10.1, <=0.10.4)

lettre CARGO version =0.10.1, =0.10.0, =0.10.0, =0.1.0, =0.111.0, =0.1.2, =1.6.0, =1.0.0, =1.3.0-beta1, =1.6.4, =0.0.1, =0.1.0, =0.1.1 and more Source cves: CVE-2026-46428 Source advisory: OSV:GHSA-4PJ9-G833-QX53...

lettre has TLS hostname verification disabled when using Boring TLS backend

Summary An inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN...

CVE-2026-46428

A flaw was found in lettre, a mailer library for Rust. An inverted-boolean bug in the boring-tls integration silently disables TLS hostname verification for users employing the default strict configuration. A remote on-path attacker can exploit this by presenting any valid TLS certificate, allowi...

CVE-2026-46428

lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...

CVE-2026-46428

CVE-2026-46428 affects the Rust mailer library lettre. Versions 0.10.1 through before 0.11.22 using the boring-tls backend have an inverted-boolean bug that silently disables TLS hostname verification under the default strict configuration. An on-path attacker presenting any chain-valid certifica...

CVE-2026-46428 lettre has TLS hostname verification disabled when using Boring TLS backend

lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...

CVE-2026-46428 lettre has TLS hostname verification disabled when using Boring TLS backend

lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...

CVE-2026-46428

lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...

CVE-2026-46428 lettre has TLS hostname verification disabled when using Boring TLS backend

lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...

anansi (>=0.10.0, <=0.14.2), anansi-core (>=0.10.0, <=0.14.2) +76 more potentially affected by CVE-2026-46428 via lettre (>=0.10.1, <=0.10.4)

lettre CARGO version =0.10.1, =0.10.0, =0.10.0, =0.1.0, =0.111.0, =0.1.2, =1.6.0, =1.0.0, =1.3.0-beta1, =1.6.4, =0.0.1, =0.1.0, =0.1.1 and more Source cves: CVE-2026-46428 Source advisory: OSV:RUSTSEC-2026-0141...

RUSTSEC-2026-0141 TLS hostname verification disabled when using Boring TLS backend

An inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN credentials and...

TLS hostname verification disabled when using Boring TLS backend

An inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN credentials and...

PT-2026-61618

Name of the Vulnerable Software and Affected Versions lettre versions 0.10.1 through 0.11.21 Description An inverted-boolean bug in the boring-tls integration silently disables TLS hostname verification for users employing the default strict configuration. This allows an on-path attacker with a...

EUVD-2021-1888

Malware in sbrugna...

EUVD-2021-1485

Malware in sbrugna...

CVE-2021-38189

An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two sequences and then inject arbitrary SMTP commands...

CVE-2020-28247

The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs...

lettre-age.be Cross Site Scripting vulnerability OBB-3238082

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...