TI-2021-15866 Aliases CVE-2021-38189 GHSA-qc36-q22q-cjw3

An issue was discovered in the lettre crate before 0.9.6 for Rust.

MEDIUM 45CWE-77Published 2021-08-08 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences and then inject arbitrary SMTP commands.

Why it matters now

EPSS 0.01494 74th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed lettre (crates.io): 0.9.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	lettre (crates.io)	0.7.0 to before 0.9.6	0.9.6	Patch available	GHSA-qc36-q22q-cjw3

— Vendor— Affected all versions Fixed in — No fix listed CNA
lettre (crates.io) Vendor— Affected 0.7.0 to before 0.9.6 Fixed in 0.9.6 Patch available GHSA-qc36-q22q-cjw3

CPE configurations NVD · 12

CPE	Versions	Role	Vendor
cpe:2.3:a:lettre:lettre::::::rust::*	before 0.9.6	Vulnerable	lettre
cpe:2.3:a:lettre:lettre:0.10.0:alpha1::::rust::*	0.10.0 alpha1	Vulnerable	lettre
cpe:2.3:a:lettre:lettre:0.10.0:alpha2::::rust::*	0.10.0 alpha2	Vulnerable	lettre
cpe:2.3:a:lettre:lettre:0.10.0:alpha3::::rust::*	0.10.0 alpha3	Vulnerable	lettre
cpe:2.3:a:lettre:lettre:0.10.0:alpha4::::rust::*	0.10.0 alpha4	Vulnerable	lettre
cpe:2.3:a:lettre:lettre:0.10.0:alpha5::::rust::*	0.10.0 alpha5	Vulnerable	lettre
cpe:2.3:a:lettre:lettre:0.10.0:beta1::::rust::*	0.10.0 beta1	Vulnerable	lettre
cpe:2.3:a:lettre:lettre:0.10.0:beta2::::rust::*	0.10.0 beta2	Vulnerable	lettre
cpe:2.3:a:lettre:lettre:0.10.0:beta3::::rust::*	0.10.0 beta3	Vulnerable	lettre
cpe:2.3:a:lettre:lettre:0.10.0:beta4::::rust::*	0.10.0 beta4	Vulnerable	lettre

cpe:2.3:a:lettre:lettre:*:*:*:*:*:rust:*:* Versions before 0.9.6 Vulnerable ·lettre
cpe:2.3:a:lettre:lettre:0.10.0:alpha1:*:*:*:rust:*:* Versions 0.10.0 alpha1 Vulnerable ·lettre
cpe:2.3:a:lettre:lettre:0.10.0:alpha2:*:*:*:rust:*:* Versions 0.10.0 alpha2 Vulnerable ·lettre
cpe:2.3:a:lettre:lettre:0.10.0:alpha3:*:*:*:rust:*:* Versions 0.10.0 alpha3 Vulnerable ·lettre
cpe:2.3:a:lettre:lettre:0.10.0:alpha4:*:*:*:rust:*:* Versions 0.10.0 alpha4 Vulnerable ·lettre
cpe:2.3:a:lettre:lettre:0.10.0:alpha5:*:*:*:rust:*:* Versions 0.10.0 alpha5 Vulnerable ·lettre
cpe:2.3:a:lettre:lettre:0.10.0:beta1:*:*:*:rust:*:* Versions 0.10.0 beta1 Vulnerable ·lettre
cpe:2.3:a:lettre:lettre:0.10.0:beta2:*:*:*:rust:*:* Versions 0.10.0 beta2 Vulnerable ·lettre
cpe:2.3:a:lettre:lettre:0.10.0:beta3:*:*:*:rust:*:* Versions 0.10.0 beta3 Vulnerable ·lettre
cpe:2.3:a:lettre:lettre:0.10.0:beta4:*:*:*:rust:*:* Versions 0.10.0 beta4 Vulnerable ·lettre

Show 2 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:lettre:lettre:0.10.0:rc1::::rust::*	0.10.0 rc1	Vulnerable	lettre
cpe:2.3:a:lettre:lettre:0.10.0:rc2::::rust::*	0.10.0 rc2	Vulnerable	lettre

cpe:2.3:a:lettre:lettre:0.10.0:rc1:*:*:*:rust:*:* Versions 0.10.0 rc1 Vulnerable ·lettre
cpe:2.3:a:lettre:lettre:0.10.0:rc2:*:*:*:rust:*:* Versions 0.10.0 rc2 Vulnerable ·lettre

Remediation

Fix · GHSA-qc36-q22q-cjw3 lettre (crates.io) Fixed in 0.9.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-38189
2026-10-03 Alias added: GHSA-qc36-q22q-cjw3

References

Exploit 1

https://rustsec.org/advisories/RUSTSEC-2021-0069.html

Advisory 1

https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md

Other 4

TI-2020-17156 The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option… CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences