Read the docs
TI-2026-34140 Aliases CVE-2026-46428GHSA-4pj9-g833-qx53

lettre has TLS hostname verification disabled when using Boring TLS backend

Priority HIGH 74CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-295.

Summary

lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's `boring-tls` integration silently disables TLS hostname verification for callers using the default (strict) configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN credentials and message contents, against any lettre user built with the `boring-tls` feature. Other TLS backends (`native-tls`, `rustls`) are unaffected. Version 0.11.22 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00319 25th percentileScored 2026-11-07
Fix Fixed lettre (lettre): 0.11.22lettre (crates.io): 0.11.22

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lettrelettre0.10.1 to before 0.11.220.11.22Patch availableCNA
—lettre (crates.io)0.10.1 to before 0.11.220.11.22Patch availableGHSA-4pj9-g833-qx53
  • lettre Vendorlettre Affected 0.10.1 to before 0.11.22 Fixed in 0.11.22 Patch available CNA
  • lettre (crates.io) Vendor— Affected 0.10.1 to before 0.11.22 Fixed in 0.11.22 Patch available GHSA-4pj9-g833-qx53

Remediation

  • Fix · CNA lettre (lettre) Fixed in 0.11.22
  • Fix · GHSA-4pj9-g833-qx53 lettre (crates.io) Fixed in 0.11.22 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46428
  2. 2026-10-03 Alias added: GHSA-4pj9-g833-qx53

References

Advisory 1

Other 5

  • TI-2021-15866 An issue was discovered in the lettre crate before 0.9.6 for Rust. CVSS 3.1CRITICAL 9.8
  • TI-2020-17156 The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option… CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences