CVE-2026-46428: Lettre Package Suffers from TLS Hostname Verification Bypass
Summary
CVE-2026-46428: lettre has TLS hostname verification disabled when using Boring TLS backend. Affects lettre versions >= 0.10.1, < 0.11.22. Fixed in 0.11.22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lettre is a Rust library designed for composing and sending emails. It supports various transport protocols, including SMTP, and offers features like TLS encryption for secure communication. However, a critical vulnerability has been identified in its integration with the Boring TLS backend, which compromises the security of email transmissions by disabling hostname verification.
Vulnerability Detail
The vulnerability arises from an inverted-boolean bug in the lettre library's boring-tls integration. This bug disables TLS hostname verification when using the default configuration, allowing an attacker to intercept SMTP submissions. An attacker can present a valid certificate for any domain, leading to potential exposure of sensitive information such as email credentials and message contents. The issue was introduced in version 0.10.1 and persists through version 0.11.21, affecting all users who rely on strict hostname verification without opting into accepting invalid hostnames.
How To Fix
Minimum fixed version
0.11.22
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually set the accept_invalid_hostnames flag to true only when connecting to trusted servers. However, this is not recommended for general use due to the inherent risks. Example code for setting the flag is as follows:
let tls = TlsParameters::builder("mail.example.com".to_owned())
.dangerous_accept_invalid_hostnames(true)
.build_boring()
.unwrap();
This should only be used in controlled environments.
Conclusion
The CVE-2026-46428 vulnerability in the lettre package poses a significant risk to users relying on the Boring TLS backend for email transmission. It is crucial to update to version 0.11.22 or later to mitigate this risk and ensure secure email communications.
See every vulnerability recorded for lettre →
FAQ
The vulnerability has a CVSS score of 9.1, indicating a critical level of severity.
All versions from 0.10.1 to 0.11.21 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If immediate updating is not possible, consider using the workaround to set the accept_invalid_hostnames flag cautiously, but be aware of the associated risks.
Yes, this vulnerability specifically affects the Boring TLS backend. Other backends like native-tls and rustls are not affected.
References
Related vulnerabilities
Recent vulnerabilities recorded for lettre.
