CRITICALcrates.io
GHSA-4pj9-g833-qx53· CVE-2026-46428, RUSTSEC-2026-0141lettre has TLS hostname verification disabled when using Boring TLS backend
Modified: 7/28/2026
package
crates.io/lettre
pkg:crates.io/lettre
CRITICAL9.8crates.io
GHSA-qc36-q22q-cjw3· CVE-2021-38189, RUSTSEC-2021-0069SMTP command injection in lettre
Modified: 11/8/2023
MEDIUM5.3crates.io
GHSA-vc2p-r46x-m3vx· CVE-2020-28247, RUSTSEC-2020-0069Argument injection in lettre
Modified: 11/8/2023
MEDIUM5.3crates.io
RUSTSEC-2020-0069· CVE-2020-28247, GHSA-vc2p-r46x-m3vxArgument injection in sendmail transport
Modified: 11/8/2023
—crates.io
RUSTSEC-2021-0069· CVE-2021-38189, GHSA-qc36-q22q-cjw3SMTP command injection in body
Modified: 11/8/2023
—crates.io
RUSTSEC-2026-0141· CVE-2026-46428, GHSA-4pj9-g833-qx53TLS hostname verification disabled when using Boring TLS backend
Modified: 7/29/2026