CVE-2026-46428: lettre has TLS hostname verification disabled when using Boring TLS backend
An inverted-boolean bug in lettre’s boring-tls integration silently
disables TLS hostname verification for callers using the default (strict)
configuration. An on-path attacker presenting any chain-valid certificate
for any domain can intercept SMTP submission, including PLAIN/LOGIN
credentials and message contents, against any lettre user built with the
boring-tls feature. Other TLS backends (native-tls, rustls) are
unaffected.
References
- github.com/advisories/GHSA-4pj9-g833-qx53
- github.com/lettre/lettre/commit/f5efffc88360dbdbfcef80f465e42d5bce68ca35
- github.com/lettre/lettre/releases/tag/v0.11.22
- github.com/lettre/lettre/security/advisories/GHSA-4pj9-g833-qx53
- nvd.nist.gov/vuln/detail/CVE-2026-46428
- rustsec.org/advisories/RUSTSEC-2026-0141.html
Code Behaviors & Features
Detect and mitigate CVE-2026-46428 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →