{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/mail/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-46428"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["lettre (\u003e= 0.10.1, \u003c 0.11.22)"],"_cs_severities":["medium"],"_cs_tags":["tls","mitm","library-vulnerability","rust","mail"],"_cs_type":"advisory","_cs_vendors":["lettre"],"content_html":"\u003cp\u003eA critical vulnerability, tracked as CVE-2026-46428, exists in the \u003ccode\u003elettre\u003c/code\u003e Rust library when compiled with the \u003ccode\u003eboring-tls\u003c/code\u003e feature. This flaw, present in versions 0.10.1 through 0.11.21, stems from an inverted boolean logic error in the \u003ccode\u003eTlsParametersBuilder\u003c/code\u003e's \u003ccode\u003eaccept_invalid_hostnames\u003c/code\u003e flag. Contrary to its intended behavior, the default strict configuration (where \u003ccode\u003eaccept_invalid_hostnames\u003c/code\u003e is \u003ccode\u003efalse\u003c/code\u003e) causes the underlying \u003ccode\u003eboring\u003c/code\u003e TLS backend to \u003cem\u003eskip\u003c/em\u003e hostname verification. This creates a severe Man-in-the-Middle (MITM) vulnerability, enabling attackers on the network path to intercept and decrypt SMTP traffic, including authentication credentials and message bodies, by presenting any chain-valid TLS certificate. The bug was introduced in PR #797, commit 985fa7e, and persists across affected versions, bypassing the security expectations of users who believe they have configured strict TLS verification.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker positions themselves on the network path between a \u003ccode\u003elettre\u003c/code\u003e client (built with \u003ccode\u003eboring-tls\u003c/code\u003e and using default-strict TLS settings) and its intended SMTP server.\u003c/li\u003e\n\u003cli\u003eThe attacker obtains a chain-valid TLS certificate for a domain they control (e.g., via Let's Encrypt for \u003ccode\u003eattacker.example\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe vulnerable \u003ccode\u003elettre\u003c/code\u003e client initiates an SMTP connection to its target mail exchanger (e.g., \u003ccode\u003email.example.com\u003c/code\u003e), configured to use TLS.\u003c/li\u003e\n\u003cli\u003eThe attacker's intermediate SMTP server intercepts the connection and presents its certificate (e.g., for \u003ccode\u003eattacker.example\u003c/code\u003e) during the TLS handshake.\u003c/li\u003e\n\u003cli\u003eDue to the inverted boolean logic in \u003ccode\u003elettre\u003c/code\u003e's \u003ccode\u003eboring-tls\u003c/code\u003e integration, the \u003ccode\u003eset_verify_hostname(false)\u003c/code\u003e call is made to the \u003ccode\u003eboring\u003c/code\u003e backend, despite the \u003ccode\u003elettre\u003c/code\u003e client being configured for strict hostname verification (\u003ccode\u003eaccept_invalid_hostnames = false\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eboring\u003c/code\u003e TLS backend, having been instructed to skip hostname verification, successfully completes the TLS handshake with the attacker's certificate, ignoring the mismatch with \u003ccode\u003email.example.com\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003elettre\u003c/code\u003e client proceeds with the SMTP transaction, sending sensitive data such as \u003ccode\u003eMAIL FROM\u003c/code\u003e, \u003ccode\u003eRCPT TO\u003c/code\u003e, message bodies, attachments, headers, and any SMTP AUTH credentials (e.g., PLAIN, LOGIN) to the attacker.\u003c/li\u003e\n\u003cli\u003eThe attacker gains full read access to confidential communications and credentials, and can potentially manipulate messages before forwarding or dropping them.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability severely impacts any \u003ccode\u003elettre\u003c/code\u003e user deploying applications that utilize the \u003ccode\u003eboring-tls\u003c/code\u003e feature and rely on the default-strict hostname verification settings. Such users are unknowingly susceptible to Man-in-the-Middle attacks, allowing an on-path attacker to intercept all SMTP communications. This includes exposure of sensitive email content, attachments, and crucially, SMTP authentication credentials (PLAIN, LOGIN, CRAM-MD5, etc.). The confidentiality and integrity of email submissions are compromised, leading to potential data breaches, unauthorized access to email accounts, and impersonation. While Cloudflare independently identified and mitigated this downstream, the core vulnerability remains in affected \u003ccode\u003elettre\u003c/code\u003e versions, requiring an upstream fix to protect all other deployments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-46428 by updating the \u003ccode\u003elettre\u003c/code\u003e library to version 0.11.22 or newer, which includes the fix.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, avoid using the \u003ccode\u003eboring-tls\u003c/code\u003e feature with \u003ccode\u003elettre\u003c/code\u003e in environments where SMTP traffic is sensitive and subject to MITM risks. Consider switching to \u003ccode\u003enative-tls\u003c/code\u003e or \u003ccode\u003erustls\u003c/code\u003e backends if feasible, as they are unaffected by this specific bug.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T14:31:43Z","date_published":"2026-07-28T14:31:43Z","id":"https://feed.craftedsignal.io/briefs/2026-07-lettre-tls-hostname-verification-bypass/","summary":"An inverted-boolean bug (CVE-2026-46428) in the `lettre` library's `boring-tls` integration silently disables TLS hostname verification for callers using the default strict configuration, allowing an on-path attacker with any chain-valid certificate to intercept SMTP submission, including credentials and message contents, from affected `lettre` clients.","title":"Lettré Library TLS Hostname Verification Bypass Vulnerability (CVE-2026-46428)","url":"https://feed.craftedsignal.io/briefs/2026-07-lettre-tls-hostname-verification-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Mail","version":"https://jsonfeed.org/version/1.1"}