CVE-2026-46428

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-46428
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46428.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-46428
Aliases
Published
2026-07-20T15:37:58.396Z
Modified
2026-07-22T05:32:40.660521044Z
Severity
  • 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
lettre has TLS hostname verification disabled when using Boring TLS backend
Details

lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default (strict) configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN credentials and message contents, against any lettre user built with the boring-tls feature. Other TLS backends (native-tls, rustls) are unaffected. Version 0.11.22 patches the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46428.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-295"
    ]
}
References

Affected packages

Git / github.com/lettre/lettre

Affected ranges

Type
GIT
Repo
https://github.com/lettre/lettre
Events
Introduced
0c9fc6cb71650e49abc37540a48ffcbc2fe38ee4
Fixed
f5efffc88360dbdbfcef80f465e42d5bce68ca35
Fixed
9b88c4ff98fd8653cb389a66f885f02efd79ee6b
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.10.1"
        },
        {
            "fixed": "0.11.22"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.10.1
v0.10.2
v0.10.3
v0.11.0
v0.11.1
v0.11.10
v0.11.11
v0.11.12
v0.11.13
v0.11.14
v0.11.15
v0.11.16
v0.11.17
v0.11.18
v0.11.19
v0.11.2
v0.11.20
v0.11.21
v0.11.3
v0.11.4
v0.11.5
v0.11.6
v0.11.7
v0.11.8
v0.11.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46428.json"