CVE-2026-46428: lettre has TLS hostname verification disabled when using Boring TLS backend
An inverted-boolean bug in lettre’s boring-tls integration silently
disables TLS hostname verification for callers using the default (strict)
configuration. An on-path attacker presenting any chain-valid certificate
for any domain can intercept SMTP submission, including PLAIN/LOGIN
credentials and message contents, against any lettre user built with the
boring-tls feature. Other TLS backends (native-tls, rustls) are
unaffected.
References
- github.com/advisories/GHSA-4pj9-g833-qx53
- github.com/lettre/lettre/commit/f5efffc88360dbdbfcef80f465e42d5bce68ca35
- github.com/lettre/lettre/releases/tag/v0.11.22
- github.com/lettre/lettre/security/advisories/GHSA-4pj9-g833-qx53
- nvd.nist.gov/vuln/detail/CVE-2026-46428
- rustsec.org/advisories/RUSTSEC-2026-0141.html
Code Behaviors & Features
Detect and mitigate CVE-2026-46428 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →