CVE-2026-46428
Received Received - Intake

TLS Hostname Verification Bypass in lettre Rust Library

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's `boring-tls` integration silently disables TLS hostname verification for callers using the default (strict) configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN credentials and message contents, against any lettre user built with the `boring-tls` feature. Other TLS backends (`native-tls`, `rustls`) are unaffected. Version 0.11.22 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-46428
EUVD
EUVD-2026-45982

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
lettre mailer_library to 0.11.22 (exc)
lettre lettre From 0.10.1 (inc) to 0.11.22 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the lettre Rust mailer library versions 0.10.1 to 0.11.21 when using the Boring TLS backend. It involves an inverted-boolean bug that disables TLS hostname verification by default, allowing attackers to intercept SMTP traffic including credentials and message contents.

Detection Guidance

Check if your system uses lettre versions 0.10.1 to 0.11.21 with the boring-tls feature enabled. Inspect Cargo.lock or dependency files for lettre and verify TLS backend configuration in SMTP transport settings.

Impact Analysis

An on-path attacker could intercept your SMTP email traffic, including login credentials and message contents, even if using a valid TLS certificate. This affects confidentiality and integrity of data sent via email using affected versions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data like credentials and message contents, potentially violating GDPR data protection requirements for confidentiality and integrity. It may also impact HIPAA compliance for handling protected health information.

Mitigation Strategies

Update lettre to version 0.11.22 or later. If using boring-tls, switch to native-tls or rustls backends as they are unaffected. Review SMTP configurations to ensure strict TLS hostname verification is enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46428. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart