CVE-2015-9096: Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or M...

Security readout for executives and security teams

Ruby's Net::SMTP library before Ruby 2.4.0 could let attacker-controlled email sender or recipient values alter the SMTP conversation. In business terms, affected applications may send unintended email commands if they build MAIL FROM or RCPT TO values from untrusted input. Exposure is most likely in legacy Ruby applications using Net::SMTP before 2.4.0, especially where envelope sender or recipient fields include user-controlled input. Debian advisories show downstream package fixes for older supported distributions. Prioritize remediation for public-facing or customer-input-driven systems that send email through Ruby Net::SMTP. The issue is old and not KEV-listed, but legacy runtimes with untrusted email fields can still create business risk through unauthorized or malformed outbound email behavior. Mitigation focus: Upgrade Ruby or packaged ruby versions to vendor-fixed releases.; Apply Debian DSA-3966 or DLA-1421-1 updates where applicable.; Review vendor guidance if using non-Debian Ruby distributions..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.