CVE-2026-46428 Details
Description
lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's `boring-tls` integration silently disables TLS hostname verification for callers using the default (strict) configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN credentials and message contents, against any lettre user built with the `boring-tls` feature. Other TLS backends (`native-tls`, `rustls`) are unaffected. Version 0.11.22 patches the issue.
A vulnerability exists in the lettre mailer library for Rust, specifically in versions 0.10.1 prior to 0.11.22, when the 'boring-tls' feature is enabled. An inverted-boolean bug in the TLS integration disables hostname verification for users relying on the default strict configuration. This flaw allows an on-path attacker to intercept SMTP submissions, including PLAIN/LOGIN credentials and message contents, by presenting any chain-valid certificate for any domain. Other TLS backends, such as 'native-tls' and 'rustls', are not affected.
Users can update to lettre version 0.11.22 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 20, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lettre/lettre/security/advisories/GHSA-4pj9-g833-qx53 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/lettre/lettre/commit/f5efffc88360dbdbfcef80f465e42d5bce68ca35 | [email protected] | |
| https://github.com/lettre/lettre/releases/tag/v0.11.22 | [email protected] | Release NotesVendor |
| https://github.com/lettre/lettre/security/advisories/GHSA-4pj9-g833-qx53 | [email protected] | AdvisoryExploitRemedyVendor |
| https://rustsec.org/advisories/RUSTSEC-2026-0141.html | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lettre | >= 0.10.1, < 0.11.22 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |