CVE-2026-46428
A bug in the lettre mailer library for Rust disables TLS hostname verification when the boring‑tls feature is used, allowing attackers on the network to intercept SMTP traffic, including usernames, passwords, and message contents. The issue is fixed in version 0.11.22.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Rust developers using the lettre library with the boring‑tls feature in versions 0.10.1 through 0.11.21.
Real-world impact
An attacker who can see the network traffic can read or modify SMTP submissions, stealing credentials and email content.
Why this severity
The CVSS score of 9.1 reflects the high impact of the vulnerability: it allows attackers to bypass TLS hostname checks, giving them full access to SMTP sessions without authentication. The score is high because the attack is local network, requires no special privileges, and can compromise confidentiality and integrity of email communications.
What to do about it
- 01Upgrade lettre to version 0.11.22 or later.
NVD-referenced vendor advisory
Timeline
- Jul 20, 2026 · 13d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 23, 2026 · 10d agoAdvisory updatedThe NVD record was last revised.