Vendor
An inverted-boolean bug (CVE-2026-46428) in the `lettre` library's `boring-tls` integration silently disables TLS hostname verification for callers using the default strict configuration, allowing an on-path attacker with any chain-valid certificate to intercept SMTP submission, including credentials and message contents, from affected `lettre` clients.