TLS hostname verification bypass in lettre boring-tls backend (CVE-2026-46428)

An inverted-boolean bug in lettre's boring-tls integration causes TLS hostname verification to be silently disabled when callers use the default strict configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submissions, exposing PLAIN/LOGIN credentials and message contents. Only the boring-tls backend is affected; native-tls and rustls backends are unaffected. Affected versions: - >=0.10.1 We recommend updating to: >=0.11.22. CVSS 9.1 · our assessment: act_now Reference: https://github.com/lettre/lettre/security/advisories/GHSA-4pj9-g833-qx53 Details: https://vuln.today/cve/CVE-2026-46428