CVE-2026-46428 lettre has TLS hostname verification disabled when using Boring TLS backend
An attacker can intercept SMTP traffic and steal credentials because TLS hostname verification is disabled in the Boring TLS backend.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46428?
CVE-2026-46428 is a critical vulnerability in lettre, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's `boring-tls` integration silently disables TLS hostname verification for callers using the default (strict) configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN credentials and message contents, against any lettre user built with the `boring-tls` feature. Other TLS backends (`native-tls`, `rustls`) are unaffected. Version 0.11.22 patches the issue.
Weakness: CWE-295
Which versions are affected by CVE-2026-46428?
3 open source packages ship an affected version, including lettre.
| Package | Affected | Fixed in |
|---|---|---|
lettre crates.io | From 0.10.1 | 0.11.22 |
lettre crates.io | From 0.10.1 | 0.11.22 |
lettre crates.io | From 0.10.1 | 0.11.22 |
How do I fix CVE-2026-46428?
Upgrade lettre to 0.11.22 or later.
Is CVE-2026-46428 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-46428 exists.
Sources
Also known as GHSA-4pj9-g833-qx53, RUSTSEC-2026-0141.