VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Aug 8, 2021· Updated Jun 17, 2026

CVE-2021-38189

CVE-2021-38189

Description

An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two sequences and then inject arbitrary SMTP commands.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
lettrecrates.io
>= 0.7.0, < 0.9.60.9.6

Affected products

14
  • Lettre/Lettre13 versions
    cpe:2.3:a:lettre:lettre:*:*:*:*:*:rust:*:*+ 12 more
    • cpe:2.3:a:lettre:lettre:*:*:*:*:*:rust:*:*range: <0.9.6
    • cpe:2.3:a:lettre:lettre:0.10.0:alpha1:*:*:*:rust:*:*
    • cpe:2.3:a:lettre:lettre:0.10.0:alpha2:*:*:*:rust:*:*
    • cpe:2.3:a:lettre:lettre:0.10.0:alpha3:*:*:*:rust:*:*
    • cpe:2.3:a:lettre:lettre:0.10.0:alpha4:*:*:*:rust:*:*
    • cpe:2.3:a:lettre:lettre:0.10.0:alpha5:*:*:*:rust:*:*
    • cpe:2.3:a:lettre:lettre:0.10.0:beta1:*:*:*:rust:*:*
    • cpe:2.3:a:lettre:lettre:0.10.0:beta2:*:*:*:rust:*:*
    • cpe:2.3:a:lettre:lettre:0.10.0:beta3:*:*:*:rust:*:*
    • cpe:2.3:a:lettre:lettre:0.10.0:beta4:*:*:*:rust:*:*
    • cpe:2.3:a:lettre:lettre:0.10.0:rc1:*:*:*:rust:*:*
    • cpe:2.3:a:lettre:lettre:0.10.0:rc2:*:*:*:rust:*:*
    • (no CPE)
  • ghsa-coords
    pkg:cargo/lettre
    Range: >= 0.7.0, < 0.9.6

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.