{"action":"Upgrade lettre to 0.11.22 or later.","affected":[{"fixed":"0.11.22","introduced":"0.10.1"}],"component":"lettre","cve_ids":["CVE-2026-46428"],"ecosystem":"crates.io","epss":0.00319,"exploited":false,"fixed_versions":["0.11.22"],"ghsa_id":"GHSA-4pj9-g833-qx53","id":"tcs_01M5KESQPWJ2AYNPBPEDFM428Q","modified_at":"2026-07-28T14:45:27.676971366Z","published_at":"2026-07-28T14:29:10Z","references":["https://osv.dev/vulnerability/GHSA-4pj9-g833-qx53","https://github.com/lettre/lettre/security/advisories/GHSA-4pj9-g833-qx53","https://nvd.nist.gov/vuln/detail/CVE-2026-46428","https://github.com/lettre/lettre/commit/f5efffc88360dbdbfcef80f465e42d5bce68ca35","https://github.com/lettre/lettre","https://github.com/lettre/lettre/releases/tag/v0.11.22","https://rustsec.org/advisories/RUSTSEC-2026-0141.html"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-4pj9-g833-qx53","url":"https://osv.dev/vulnerability/GHSA-4pj9-g833-qx53"},{"source":"nvd","source_id":"CVE-2026-46428","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46428"}],"summary":"lettre has TLS hostname verification disabled when using Boring TLS backend"}