What’s Vulnerable › Vulnerabilities

CVE-2021-38189

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-08-08 · updated 2026-06-17
• Weakness: CWE-77

Description

An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences and then inject arbitrary SMTP commands.

Affected products

• lettre: before 0.9.6; 0.10.0-alpha1, 0.10.0-alpha2, 0.10.0-alpha3, 0.10.0-alpha4, 0.10.0-alpha5, 0.10.0-beta1 (+5) — fixed in 0.9.6

How to fix

Upgrade to a fixed version: lettre 0.9.6. Check the vendor advisory for mitigations.

References

• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md
• https://rustsec.org/advisories/RUSTSEC-2021-0069.html
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md
• https://rustsec.org/advisories/RUSTSEC-2021-0069.html

Get alerted when CVE-2021-38189 or the next vulnerability affects your stack