CVE-2026-46428 in Rust
Summary
by MITRE • 07/20/2026
lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's `boring-tls` integration silently disables TLS hostname verification for callers using the default (strict) configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN credentials and message contents, against any lettre user built with the `boring-tls` feature. Other TLS backends (`native-tls`, `rustls`) are unaffected. Version 0.11.22 patches the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability in lettre library represents a critical security flaw that undermines the integrity of email transmission through SMTP protocols. This issue affects versions 0.10.1 through 0.11.21 where the integration with boring-tls creates a dangerous condition that silently disables TLS hostname verification. The root cause lies in an inverted boolean logic error within the library's TLS configuration handling, specifically when using the boring-tls feature flag. This flaw essentially removes the cryptographic assurance that prevents man-in-the-middle attacks by allowing any valid certificate chain to be accepted regardless of the target domain.
The technical implementation of this vulnerability stems from a fundamental misconfiguration in how hostname verification is toggled within the TLS layer. When lettre users employ the default strict configuration with boring-tls backend, the boolean condition that should enforce hostname validation becomes inverted, creating a security bypass that operates silently without alerting developers or end-users to the compromised state. This misconfiguration transforms what should be a secure communication channel into an insecure one where attackers can exploit the absence of proper certificate validation.
The operational impact of this vulnerability is severe and far-reaching across email infrastructure that relies on lettre's SMTP capabilities. An attacker positioned in a man-in-the-middle position can intercept all SMTP submissions including authentication credentials, which typically use PLAIN or LOGIN mechanisms, along with complete message contents. This provides attackers with full access to sensitive email communications, potentially exposing confidential business information, personal data, or security credentials that rely on email-based authentication systems. The vulnerability affects any application built with the boring-tls feature, making it particularly concerning for applications that prioritize security through TLS encryption.
The affected environment specifically targets developers using lettre version 0.10.1 through 0.11.21 with the boring-tls integration, while native-tls and rustls backends remain unaffected by this particular bug. This differential impact means organizations must carefully evaluate their TLS backend choices and upgrade to version 0.11.22 or later to remediate the issue. The vulnerability aligns with CWE-295 which addresses improper certificate validation in TLS implementations, and maps to ATT&CK technique T1566 related to credential access through man-in-the-middle attacks. Organizations should immediately implement patch management procedures to upgrade lettre to version 0.11.22 or higher and conduct security audits of email infrastructure that may be vulnerable to this attack vector. The fix implemented in version 0.11.22 corrects the boolean logic error, restoring proper hostname verification functionality for users employing the boring-tls backend.