CVE-2026-46428: lettre Inverted Boolean Disables TLS Hostname Verification (boring-tls)

// Cargo.toml: lettre = { version = ">=0.10.1,<0.11.22", features = ["boring-tls"] }
// Default-strict config -- looks safe, but hostname verification is OFF under boring-tls.

use lettre::transport::smtp::client::{Tls, TlsParameters};
use lettre::{AsyncSmtpTransport, Tokio1Executor, Message, Transport};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // accept_invalid_hostnames defaults to false ("strict") --
    // but boring receives verify_hostname(false), so verification is SKIPPED.
    let tls = TlsParameters::builder("mail.example.com".to_owned())
        .build_boring()
        .unwrap();

    let mailer = AsyncSmtpTransport::<Tokio1Executor>::relay("mail.example.com")?
        .tls(Tls::Required(tls))
        .build();

    // Attacker on the network path presents a cert for attacker.example
    // (signed by any trusted CA). boring accepts the handshake because
    // verify_hostname was called with false. lettre completes the SMTP
    // transaction against the attacker, leaking credentials and message.
    let message = Message::builder()
        .from("sender@example.com".parse()?)
        .to("recipient@example.com".parse()?)
        .subject("Test")
        .body("Body".to_string())?;

    mailer.send(message).await?; // succeeds against attacker SMTP server
    Ok(())
}