AIKIDO-2026-10832
lettre is vulnerable to Improper Certificate Validation
91
Critical Risk
This Affects:
lettreTL;DR
The optional Boring TLS integration passed lettre’s accept-invalid-hostnames knob straight into Boring’s verify_hostname API, but that API uses the opposite polarity. Default strict callers therefore skipped hostname checks while still believing TLS named the configured server, so an on-path peer could complete TLS with an unrelated chain-valid certificate and read or tamper with SMTP traffic including credentials. Negating the flag at both sync and async upgrade sites restores intended semantics and matches native-tls and rustls behavior.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and boring-tls is enabled.
Background info
lettre is vulnerable to Improper Certificate Validation in versions 0.10.1 - 0.11.21.
How to fix this
Upgrade the lettre library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant