Vulnerability RUSTSEC-2026-0141
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 months ago
May 14, 2026 at 12:00 PM UTC
TLS hostname verification disabled when using Boring TLS backend
0.10.1 - 0.11.21
0.10.1 - 0.11.21
Summary
TLS hostname verification disabled when using Boring TLS backend
Details
An inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default (strict) configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN credentials and message contents, against any lettre user built with the boring-tls feature. Other TLS backends (native-tls, rustls) are unaffected.
The bug was introduced in v0.10.1 and persists through v0.11.21 (latest).
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
2 months ago
lettre has TLS hostname verification disabled when using Boring TLS backend
0.10.1 - 0.11.21 GHSA-4pj9-g833-qx53
0.10.1 - 0.11.21 GHSA-4pj9-g833-qx53
Medium Risk
5 years ago
Argument injection in lettre
0.7.0 and 0.8.0 - 0.8.3 and 0.9.0 - 0.9.3 GHSA-vc2p-r46x-m3vx
0.7.0 and 0.8.0 - 0.8.3 and 0.9.0 - 0.9.3 GHSA-vc2p-r46x-m3vx
Critical
5 years ago
SMTP command injection in lettre
0.7.0 - 0.9.5 GHSA-qc36-q22q-cjw3
0.7.0 - 0.9.5 GHSA-qc36-q22q-cjw3
Unknown
5 years ago
SMTP command injection in body
0.7.0 - 0.9.5 RUSTSEC-2021-0069
0.7.0 - 0.9.5 RUSTSEC-2021-0069
Medium Risk
5 years ago
Argument injection in sendmail transport
0.7.0 RUSTSEC-2020-0069
0.7.0 RUSTSEC-2020-0069
Impacted packages
Timeline
Published
5 months ago
May 14, 2026 at 12:00 PM UTC
Fixed (0.11.22)
5 months ago
May 14, 2026 at 08:57 AM UTC
Last Modified
1 hour ago
October 12, 2026 at 06:00 PM UTC