—
RUSTSEC-2026-0141
TLS hostname verification disabled when using Boring TLS backend
Details
An inverted-boolean bug in lettre's `boring-tls` integration silently disables TLS hostname verification for callers using the default (strict) configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN credentials and message contents, against any lettre user built with the `boring-tls` feature. Other TLS backends (`native-tls`, `rustls`) are unaffected.
The bug was introduced in v0.10.1 and persists through v0.11.21 (latest).
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io / lettre
Introduced in:
0.10.1 Fixed in: 0.11.22 Upgrade lettre to 0.11.22 or newer (ecosystem crates.io).