Skip to content
OpenAdvisories

Package · crates.io

lettre

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.1
    CVE-2026-46428

    lettre has TLS hostname verification disabled when using Boring TLS backend

    lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's `boring-tls` integration silently disables TLS hostname verification for callers using the default (strict) configuration. An o…

    lettre lettre lettre crates.io
  • Critical 9.8
    CVE-2021-38189

    SMTP command injection in lettre

    An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences and then inject arbitrary SMTP commands.

    lettre crates.io
  • Medium 5.3
    CVE-2020-28247

    Argument injection in lettre

    The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.

    lettre crates.io