CVE-2015-9097: The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection...

Security readout for executives and security teams

Older versions of the Ruby mail gem could let specially crafted email sender or recipient values inject extra SMTP commands. This matters most for Ruby applications that pass user-controlled email addresses into mail sending. The bundle does not provide CVSS, KEV listing, or confirmed active exploitation evidence. Exposure is likely limited to Ruby applications using mail gem versions before 2.5.5, especially where sender or recipient fields can be influenced by users, imports, APIs, or upstream systems. Address during normal vulnerability remediation unless the organization has affected Ruby mail workflows with untrusted address input. Escalate for customer-facing signup, invitation, support, or notification systems using old dependencies. Mitigation focus: Upgrade the Ruby mail gem to version 2.5.5 or later.; Review Gemfile.lock and deployed artifacts for vulnerable mail gem versions.; Validate and normalize sender and recipient inputs before mail generation..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.