CVE-2011-0739: The deliver function in the sendmail delivery agent (lib/mail/network/delivery_methods/sendmail.rb) in Ruby...

Security readout for executives and security teams

This issue affects old Ruby Mail gem versions where an email address could be handled unsafely by the sendmail delivery method. If an application lets an attacker control recipient or sender address fields and then sends mail through this path, command execution may be possible on the server. Exposure is most likely in legacy Ruby applications using Mail gem 2.2.14 or earlier with the sendmail delivery agent and attacker-influenced email address fields. Prioritize remediation for internet-facing or customer-facing Ruby systems that send email. The business risk is server compromise, but urgency depends on whether legacy Mail gem and sendmail delivery are actually present. Mitigation focus: Inventory Ruby applications using the Mail gem and identify versions 2.2.14 or earlier.; Check whether the application uses the sendmail delivery method.; Review upstream vendor guidance and the referenced 20110126 sendmail patch..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.