# CVE-2026-46428: lettre TLS hostname verification bypass in boring-tls backend

Source: https://junglewise.ai/threats/cve-2026-46428-lettre-tls-hostname-verification-bypass-in-boring-tls-backend  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-46428 · Severity: critical · CVSS 4 · Published 2026-07-20

Lettre, a popular Rust library for sending emails, contains a flaw when using the BoringSSL security backend that silently disables identity verification for mail servers. This allows a sophisticated attacker positioned on the network to impersonate a legitimate email server and intercept sensitive communications. If exploited, an attacker could steal email login credentials, read private message contents, or modify emails before they are sent.

Technologies: [lettre (crates.io)](https://junglewise.ai/threats/technologies/crates-io-lettre). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-46428 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46428 being exploited in the wild.

**How severe is CVE-2026-46428?** Critical severity, with a CVSS score of 4, published 20 July 2026.

**Which products and versions are affected?** lettre (crates.io) SEMVER:introduced=0.10.1,fixed=0.11.22; Lettre >= 0.10.1, < 0.11.22.

**Is there a fix for CVE-2026-46428?** Yes. lettre (crates.io): upgrade to 0.11.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46428 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46428?** Check whether you run lettre (crates.io) or Lettre at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lettre (crates.io): upgrade to 0.11.22 or later

  ```sh
  cargo update -p lettre
  ```


## Technical details

An inverted-boolean bug in lettre's `boring-tls` integration causes the library to skip TLS hostname verification when the default strict configuration is used. The vulnerability stems from `TlsParametersBuilder` passing its `accept_invalid_hostnames` flag directly to BoringSSL's `set_verify_hostname` API, which uses opposite logic (true means verify, false means skip). An on-path attacker with a valid certificate for any domain can successfully perform a man-in-the-middle attack against SMTP sessions, gaining access to SMTP AUTH credentials and message bodies. This issue affects both synchronous and asynchronous implementations in versions 0.10.1 through 0.11.21 when the `boring-tls` feature is enabled. The fix involves negating the flag at the BoringSSL call sites, and it is addressed in version 0.11.22.

## Affected products

- lettre lettre >= 0.10.1, < 0.11.22

## Identifiers

- CVE-2026-46428
- GHSA-4pj9-g833-qx53
- RUSTSEC-2026-0141

## Timeline

- 2026-05-12: other: Downstream mitigation by Cloudflare email-fwdr
- 2026-05-14: advisory: Initial GitHub Advisory published
- 2026-07-28: advisory: Advisory updated

## References

- [https://api.github.com/users/edevil](https://api.github.com/users/edevil)
- [https://github.com/edevil](https://github.com/edevil)
- [https://api.github.com/users/edevil/gists%7B/gist_id%7D](https://api.github.com/users/edevil/gists%7B/gist_id%7D)
- [https://api.github.com/users/edevil/repos](https://api.github.com/users/edevil/repos)
- [https://avatars.githubusercontent.com/u/12426?v=4](https://avatars.githubusercontent.com/u/12426?v=4)
- [https://api.github.com/users/edevil/events%7B/privacy%7D](https://api.github.com/users/edevil/events%7B/privacy%7D)

## Related threats

- [RUSTSEC-2021-0069 - SMTP command injection in body](https://junglewise.ai/threats/cve-2021-38189-smtp-command-injection-in-lettre)
- [RUSTSEC-2020-0069 - Argument injection in sendmail transport](https://junglewise.ai/threats/cve-2020-28247-argument-injection-in-lettre)