CARGO · JULY 2026 · EARLY WARNING

lettre Rust Crate TLS Bug May Expose SMTP Data

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

GHSA-4PJ9-G833-QX53Severity: HIGH

An issue has been reported in the lettre Rust crate that may disable TLS hostname verification when using the Boring TLS backend, potentially allowing SMTP interception.

What happened

Reportedly, the lettre Rust crate has a bug that disables TLS hostname verification when using the Boring TLS backend. This appears to allow an attacker to intercept SMTP submission, including credentials and message contents. Other TLS backends are unaffected. The vulnerability is under investigation and the affected versions range from 0.7.0 to 0.10.1, with fixes available in versions 0.7.1, 0.8.4, 0.9.5, 0.9.6, and 0.11.22. It is recommended to await a patch from the lettre maintainers. Until then, avoid using the `boring-tls` feature or use alternative TLS backends. For more details, consult the primary sources.

How 0Day mitigates this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If lettre is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Join the 0Day waitlist →

← Back to all threats