{"action":"Upgrade lettre to 0.11.22 or later.","affected":[{"fixed":"0.11.22","introduced":"0.10.1"}],"component":"lettre","cve_ids":["CVE-2026-46428"],"ecosystem":"crates.io","epss":0.00319,"exploited":false,"fixed_versions":["0.11.22"],"ghsa_id":"GHSA-4pj9-g833-qx53","id":"tcs_01M5KFBFQCJVRAMCAKN8G0R6YT","modified_at":"2026-10-12T18:00:14.045169536Z","published_at":"2026-05-14T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0141","https://crates.io/crates/lettre","https://rustsec.org/advisories/RUSTSEC-2026-0141.html","https://github.com/lettre/lettre/commit/f5efffc88360dbdbfcef80f465e42d5bce68ca35"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0141","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0141"},{"source":"nvd","source_id":"CVE-2026-46428","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46428"}],"summary":"TLS hostname verification disabled when using Boring TLS backend"}