lettre has TLS hostname verification disabled when using Boring TLS backend

• .verify_hostname(*accept_invalid_hostnames)

• .verify_hostname(!*accept_invalid_hostnames)

• config.set_verify_hostname(accept_invalid_hostnames);

• config.set_verify_hostname(!accept_invalid_hostnames); I have the patch ready locally and can push to a private fork if a collaborative fix branch is preferred.

PoC

Setup (any lettre version >= v0.10.1, built with the boring-tls feature, default-strict configuration):

1. Generate a TLS cert for any hostname the attacker controls, e.g. attacker.example, signed by any CA in the client's trust store (e.g. a Let's Encrypt cert is sufficient).
2. Stand up an attacker SMTP server on the network path between the lettre client and the intended MX. Have it present the attacker.example cert on STARTTLS or implicit TLS.
3. Use lettre with default-strict TLS to send to the real MX hostname, e.g. mail.example.com: use lettre::transport::smtp::client::{Tls, TlsParameters}; use lettre::{AsyncSmtpTransport, Tokio1Executor, Message}; let tls = TlsParameters::builder("mail.example.com".to_owned()) .build_boring() .unwrap(); let mailer = AsyncSmtpTransport::<Tokio1Executor>::relay( "mail.example.com", )? .tls(Tls::Required(tls)) .build(); mailer.send(message).await?; // succeeds against attacker Expected with hostname verification: handshake fails because the presented leaf cert's SAN does not match mail.example.com. Actual on boring-tls: handshake succeeds. lettre proceeds with the SMTP transaction, sending MAIL FROM, RCPT TO, message body, and any configured SMTP AUTH credentials to the attacker. Symmetric inverse PoC (proves the inversion, not just a missing check): configure .dangerous_accept_invalid_hostnames(true) and try to connect to a server whose cert SAN matches the connect domain. With the bug, the handshake fails because lettre passes true to verify_hostname and boring rejects... actually wait, it succeeds (SAN matches). Better inverse demonstration: connect to a server whose cert SAN matches the connect domain with accept_invalid_hostnames=true, then connect to a mismatched-SAN server with the same flag — the latter is rejected, proving the flag is inverted (the user opted into accepting any name, yet lettre enforces strict verification). A reproducer cargo project can be produced on request.

Impact

Who is impacted: any lettre user who

1. enables the boring-tls feature, AND
2. relies on default-strict hostname verification (i.e. does NOT call .dangerous_accept_invalid_hostnames(true)). This is the entire "I want strict TLS" population on boring-tls. They get the opposite of what they asked for: a TLS handshake that ignores hostname mismatch. Exploitation: an attacker on the network path between the lettre client and the target SMTP server, holding any chain-valid TLS certificate (e.g. a free Let's Encrypt cert for a domain the attacker owns), can present that certificate when the lettre client connects to the intended MX. boring accepts the handshake, lettre proceeds, and the attacker gains read/write access to:

• SMTP envelope (MAIL FROM, RCPT TO)
• Message bodies, attachments, headers
• Any SMTP AUTH credentials (PLAIN, LOGIN, CRAM-MD5, etc.)
• Any DKIM signatures and DMARC alignment downstream depends on can be inspected and selectively dropped Confidentiality and integrity impact: High. Availability impact: None direct (the attacker can choose to forward or drop, but the bug itself does not deny service). Cloudflare's email-fwdr independently identified and mitigated this downstream by promoting a previously-metric-only post-handshake SAN check to a hard error (fix landed 2026-05-12). Because we're mitigated downstream, we are not on a publication clock; we are reporting so the upstream fix can ship and other lettre+boring-tls deployments can stop relying on per-caller workarounds. Happy to coordinate on embargo timing. Affected versions: every released lettre version with boring-tls support, from v0.10.1 (PR #797, commit 985fa7e) through v0.11.21 (latest). No prior advisory or fix. Suggested fix: two-line negation of the flag at the boring call sites (see Details). Patch is ready locally and can be attached to a private collaboration fork.