Disadvantages of AES-CTR? On paper, it sounds *very* good to me:

secure
fast (in my tests it's somewhat slower than ECB (but without most of the weaknesses, more on that below) but faster than every other alternative I tested, which were ECB, CTR, CBC, OFB, CFB written in order of performance (link to benchmark code) )
simple to understand
does not require padding (which I guess significantly reduces the chance of implementing padding in an insecure manner)
support parallelization (for both encryption and decryption)
support random access

.. the only disadvantage I can think of, is that because it does not require padding, implementations in practice will probably reveal the exact message length, as compared to revealing circa-message-lengths (e.g. padded schemes may reveal something like the message is within 15 bytes of this length, while non-padded schemes may reveal the message is *exactly* this long), and if that's a concern, it's not like it can't be mitigated by just adding padding anyway.
I guess I'm missing something, so...
What are the disadvantages?
Disadvantages:

Message length: In Cryptography, usually, the message length is not considered secret. There are approaches that you can add random values to the end or beginning or both if this is really an information leak for you. The random approach depends on your actual data case. It is also possible that a pre-determined fixed size can be used as the e-mail can be limited to 512 characters. In the end, at least the upper bound is revealed in all of the cases.

The (IV, key) pair reuse is a real problem that can eliminate the confidentiality with the crib-dragging technique. This doesn't reveal the encryption key.

Lack of authentication Like all unauthenticated encryption modes, the bare CTR mode lacks integrity and authentication. A single bit of flipping can have catastrophic results due to the malleability of the CTR mode.
The AES-GCM mode that uses the CTR mode of operation provides you all-in-once, however, it has the same  (IV, key) pair reuse problem. There is a Synthetic Initialization Vector (SIV) mode as nonce-misuse resistance ( paper, rfc8452 ) that eliminates this. SIV mode can still leak that the same message is sent under the same key, so an observer can distinguish this.

Long message distinguisher:  The CTR mode is designed with a Pseudo-Random-Function (PRF). When using AES in CTR mode, we use it with Pseudo Random Permutation (PRP); $$E_k\colon \{0,1\}^n \to \{0,1\}^n.$$ Whit PRP as long as the message blocks are not repeated the sequence $E_k(0), E_k(1), \dots, E_k(\ell - 1)$ with $\ell &lt; 2^n$ is not repeated. If the message with length $\ell$-block has no repeated block this is no problem. If we approach the message as uniform random block then we expect a collision $\ell \approx \sqrt{2^n} = 2^{n/2}$ by the birthday paradox/attack.
When used with AES-128 for long messages check for the repeat. The repeat enables the attacker to distinguish this from uniform random with non-negligible probability.
In short, a duplicate ciphertext in any position leaks that the messages are different.

Message size per key: although NIST say 64 nonce and 64 bit counter, one should stop using a key well before $2^{64}$ block. This is due to using a PRP (AES) instead of PRF in CTR mode.



Other advantages:

No need for the decryption: CTR mode doesn't require decryption of the block cipher, it always uses them for encryption. This is very helpful in constraint environments. Simplifies the software and hardware code, too.

No need PRP: Doesn't need a block cipher (PRP) at all. A hash function can be used like in the ChaCha series.

Prepocessing: the keystream generated by the CTR mode can be prepared before. This can help to use buffers.

CTR mode has CPA security.



A little history of CTR
CTR mode was introduced by Whitfield Diffie and Martin Hellman in 1979

Privacy and Authentication: An Introduction to Cryptography as an invited paper on Proceedings of the IEEE, 67 (1979), pp. 397–427.

A concrete Security of Treatment of Symmetric Encryption, Bellare et. al, 97 provides the security bounds.

See also; Comments to NIST concerning AES Modes of Operations: CTR-Mode Encryption, by Lipmaa et al. for other details of advantages and disadvantages.