Vulnerabilities

TI-2026-34140 CVE-2026-46428 · GHSA-4pj9-g833-qx53

lettre has TLS hostname verification disabled when using Boring TLS backend

HIGH 74

lettre is a a mailer library for Rust.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00319 Published 2026-07-20 Fixed in 0.11.22 CWE-295

TI-2021-15866 CVE-2021-38189 · GHSA-qc36-q22q-cjw3

MEDIUM 45

An issue was discovered in the lettre crate before 0.9.6 for Rust.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01494 Published 2021-08-08 Fixed in 0.9.6 CWE-77

TI-2020-17156 CVE-2020-28247 · GHSA-vc2p-r46x-m3vx

LOW 27

The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01522 Published 2020-11-12 Fixed in 0.9.5, 0.8.4 +1 CWE-77