CVE-2021-38189: Lettre

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences and then inject arbitrary SMTP commands.

Affected products

• Lettre Lettre: before 0.9.6 (fixed in 0.9.6); version 0.10.0 only

Published 2021-08-08. Last modified 2026-06-17.