GHSA-q86f-fmqf-qrf6 CVE-2015-9097
Mail Gem CRLF Injection vulnerability
- Severity
- 6.1 / 10
- Medium · CVSS 3.0
- Exploit chance (EPSS)
- 3.40%
- Chance of exploitation in the next 30 days. Higher than 88.83% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
- Fix
2.5.5- Upgrade mail to this version or later
Description
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
< 2.5.5 |
2.5.5 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
mail RubyGems → 2.5.5
- bundler
bundle update mail # Gemfile: gem "mail", ">= 2.5.5"
Severity breakdown
CVSS 3.0 6.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
How to prevent it
- Implementation: Avoid using CRLF as a special sequence.
- Implementation: Appropriately filter or quote CRLF sequences in user-controlled input.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-mvxr-6m87-mv2q Mail: Email address spoofing via malformed RFC 2047 encoded-words | Medium | Also affects mail |
| GHSA-rp63-jfmw-532w Mail Gem Improper Input Validation vulnerability | High | Also affects mail |
| GHSA-cpjc-p7fc-j9xh Mail Improper Input Validation vulnerability | Medium | Also affects mail |
| GHSA-cj92-c4fj-w9c5 Mail Gem Path Traversal vulnerability | Medium | Also affects mail |
| GHSA-h4x7-gw46-3wm6 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers | Medium | Same weakness, CWE-93 |
| GHSA-j9f9-w8pj-32f8 Spring Framework Server Sent Event stream corruption while rendering fragments | Critical | Same weakness, CWE-93 |
| EEF-CVE-2026-75484 HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit | Not rated yet | Same weakness, CWE-93 |
| GHSA-8c48-q9wj-3w37 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines | Medium | Same weakness, CWE-93 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor