An inverted‑boolean bug in lettre’s Boring TLS integration causes TLS hostname verification to be silently disabled for callers using the default strict configuration. The absence of hostname verification allows an on‑path attacker to present any chain‑valid certificate for any domain and intercept SMTP submissions, capturing plain‑text credentials and message contents. This flaw is identified as CWE‑295 and exposes confidentiality of mail traffic to remote attackers.

Vulnerable versions of the lettre mailer library, from 0.10.1 up to 0.11.21, when built with the `boring-tls` feature, are affected. The issue does not impact builds using the native‑tls or rustls backends.

The CVSS score of 9.1 reflects a high‑severity risk due to the potential for credential theft and message compromise. EPSS score < 1% indicates a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA KEV, but the high score and the ease of exploitation—requiring only that the attacker be positioned on the network path and present a valid certificate—make it a significant threat for applications relying on lettre for SMTP transport. The attack is likely to target systems that use the library without additional host‑name verification controls.