A really Ruby Mail handler.
View on Github
Activity
- Latest release
- 2mo ago
- Total releases
- 97
- Cadence
- ~16 days
- Last 12 months
- 2
Reach
- Stars
- —
Details
- License
- MIT
- First release
- Oct 24, 2009
| Version | Released | |
|---|---|---|
2.9.1
patch
| ||
2.9.0
minor
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.9.0.beta1
pre
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.9.0.beta1
pre
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
2.9.0.beta2
pre
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.9.0.beta2
pre
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
2.8.1
patch
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.8.1
patch
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
2.8.1.rc2
pre
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.8.1.rc2
pre
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
2.8.0.1.rc1
pre
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.8.0.1.rc1
pre
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
2.8.0.1
patch
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.8.0.1
patch
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
2.8.0
minor
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.8.0
minor
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
2.8.0.rc2
pre
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.8.0.rc2
pre
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
2.8.0.rc3
pre
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.8.0.rc3
pre
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
2.8.0.rc1
pre
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.8.0.rc1
pre
Dependencies (10)
+ 2 more
Changelog
Compare changes
|
|
2.7.1
patch
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.7.1.rc1
pre
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.7.0
minor
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.7.0.rc3
pre
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.7.0.rc2
pre
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.6.6
patch
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.5.5
patch
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.7.0.rc1
pre
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.6.6.rc1
pre
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.5.5.rc1
pre
2 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.6.5
patch
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.6.5.rc1
pre
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.6.4
patch
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.6.4.rc2
pre
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.6.4.rc1
pre
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.6.3
patch
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.6.1
patch
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.6.0
minor
1 CVE
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
2.5.4
patch
2 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.2.20
patch
4 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2012-2139
GHSA-cj92-c4fj-w9c5
Oct 24, 2017
Mail Gem Path Traversal vulnerability
Medium
Directory traversal vulnerability in Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 51 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
Fixed in
2.4.4
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2012-2140
GHSA-rp63-jfmw-532w
Oct 24, 2017
Mail Gem Improper Input Validation vulnerability
High
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 50 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
Fixed in
2.4.3
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.5.3
patch
2 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.5.2
minor
2 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.4.4
patch
2 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.3.3
patch
4 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2012-2139
GHSA-cj92-c4fj-w9c5
Oct 24, 2017
Mail Gem Path Traversal vulnerability
Medium
Directory traversal vulnerability in Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 51 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
Fixed in
2.4.4
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2012-2140
GHSA-rp63-jfmw-532w
Oct 24, 2017
Mail Gem Improper Input Validation vulnerability
High
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 50 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
Fixed in
2.4.3
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.4.3
patch
3 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2012-2139
GHSA-cj92-c4fj-w9c5
Oct 24, 2017
Mail Gem Path Traversal vulnerability
Medium
Directory traversal vulnerability in Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 51 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
Fixed in
2.4.4
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.3.2
patch
4 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2012-2139
GHSA-cj92-c4fj-w9c5
Oct 24, 2017
Mail Gem Path Traversal vulnerability
Medium
Directory traversal vulnerability in Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 51 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
Fixed in
2.4.4
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2012-2140
GHSA-rp63-jfmw-532w
Oct 24, 2017
Mail Gem Improper Input Validation vulnerability
High
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 50 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
Fixed in
2.4.3
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.4.1
patch
4 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2012-2139
GHSA-cj92-c4fj-w9c5
Oct 24, 2017
Mail Gem Path Traversal vulnerability
Medium
Directory traversal vulnerability in Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 51 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
Fixed in
2.4.4
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2012-2140
GHSA-rp63-jfmw-532w
Oct 24, 2017
Mail Gem Improper Input Validation vulnerability
High
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 50 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
Fixed in
2.4.3
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.4.0
minor
4 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2012-2139
GHSA-cj92-c4fj-w9c5
Oct 24, 2017
Mail Gem Path Traversal vulnerability
Medium
Directory traversal vulnerability in Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 51 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
Fixed in
2.4.4
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2012-2140
GHSA-rp63-jfmw-532w
Oct 24, 2017
Mail Gem Improper Input Validation vulnerability
High
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 50 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
Fixed in
2.4.3
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.2.19
patch
4 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2012-2139
GHSA-cj92-c4fj-w9c5
Oct 24, 2017
Mail Gem Path Traversal vulnerability
Medium
Directory traversal vulnerability in Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 51 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
Fixed in
2.4.4
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2012-2140
GHSA-rp63-jfmw-532w
Oct 24, 2017
Mail Gem Improper Input Validation vulnerability
High
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 50 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
Fixed in
2.4.3
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.3.0
minor
4 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2012-2139
GHSA-cj92-c4fj-w9c5
Oct 24, 2017
Mail Gem Path Traversal vulnerability
Medium
Directory traversal vulnerability in Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 51 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
Fixed in
2.4.4
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2012-2140
GHSA-rp63-jfmw-532w
Oct 24, 2017
Mail Gem Improper Input Validation vulnerability
High
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 50 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
Fixed in
2.4.3
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.2.18
patch
4 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2012-2139
GHSA-cj92-c4fj-w9c5
Oct 24, 2017
Mail Gem Path Traversal vulnerability
Medium
Directory traversal vulnerability in Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 51 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
Fixed in
2.4.4
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2012-2140
GHSA-rp63-jfmw-532w
Oct 24, 2017
Mail Gem Improper Input Validation vulnerability
High
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 50 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
Fixed in
2.4.3
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.2.17
patch
4 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2012-2139
GHSA-cj92-c4fj-w9c5
Oct 24, 2017
Mail Gem Path Traversal vulnerability
Medium
Directory traversal vulnerability in Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 51 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
Fixed in
2.4.4
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2012-2140
GHSA-rp63-jfmw-532w
Oct 24, 2017
Mail Gem Improper Input Validation vulnerability
High
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 50 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
Fixed in
2.4.3
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.2.16
patch
4 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2012-2139
GHSA-cj92-c4fj-w9c5
Oct 24, 2017
Mail Gem Path Traversal vulnerability
Medium
Directory traversal vulnerability in Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 51 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
Fixed in
2.4.4
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2012-2140
GHSA-rp63-jfmw-532w
Oct 24, 2017
Mail Gem Improper Input Validation vulnerability
High
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 50 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
Fixed in
2.4.3
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.2.15
patch
4 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2012-2139
GHSA-cj92-c4fj-w9c5
Oct 24, 2017
Mail Gem Path Traversal vulnerability
Medium
Directory traversal vulnerability in Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 51 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
Fixed in
2.4.4
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2012-2140
GHSA-rp63-jfmw-532w
Oct 24, 2017
Mail Gem Improper Input Validation vulnerability
High
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 50 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
Fixed in
2.4.3
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.2.14
patch
5 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2012-2139
GHSA-cj92-c4fj-w9c5
Oct 24, 2017
Mail Gem Path Traversal vulnerability
Medium
Directory traversal vulnerability in Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 51 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
Fixed in
2.4.4
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2011-0739
GHSA-cpjc-p7fc-j9xh
Oct 24, 2017
Mail Improper Input Validation vulnerability
Medium
The deliver function in the sendmail delivery agent ( Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 39 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.2
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
Fixed in
2.2.15
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2012-2140
GHSA-rp63-jfmw-532w
Oct 24, 2017
Mail Gem Improper Input Validation vulnerability
High
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 50 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
Fixed in
2.4.3
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.2.13
patch
5 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2012-2139
GHSA-cj92-c4fj-w9c5
Oct 24, 2017
Mail Gem Path Traversal vulnerability
Medium
Directory traversal vulnerability in Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 51 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
Fixed in
2.4.4
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2011-0739
GHSA-cpjc-p7fc-j9xh
Oct 24, 2017
Mail Improper Input Validation vulnerability
Medium
The deliver function in the sendmail delivery agent ( Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 39 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.2
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
Fixed in
2.2.15
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2012-2140
GHSA-rp63-jfmw-532w
Oct 24, 2017
Mail Gem Improper Input Validation vulnerability
High
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 50 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
Fixed in
2.4.3
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.2.12
patch
5 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2012-2139
GHSA-cj92-c4fj-w9c5
Oct 24, 2017
Mail Gem Path Traversal vulnerability
Medium
Directory traversal vulnerability in Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 51 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
Fixed in
2.4.4
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2011-0739
GHSA-cpjc-p7fc-j9xh
Oct 24, 2017
Mail Improper Input Validation vulnerability
Medium
The deliver function in the sendmail delivery agent ( Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 39 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.2
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
Fixed in
2.2.15
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2012-2140
GHSA-rp63-jfmw-532w
Oct 24, 2017
Mail Gem Improper Input Validation vulnerability
High
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 50 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
Fixed in
2.4.3
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev | ||
2.2.11
patch
5 CVEs
CVE-2026-63435
GHSA-mvxr-6m87-mv2q
Sep 02, 2026
Mail: Email address spoofing via malformed RFC 2047 encoded-words
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
SummaryMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address. DetailsBoth decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:
ImpactApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 84 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5.rc1
2.6.0
2.6.1
2.6.3
2.6.4
2.6.4.rc1
2.6.4.rc2
2.6.5
2.6.5.rc1
2.6.6
2.6.6.rc1
2.7.0
2.7.0.rc1
2.7.0.rc2
2.7.0.rc3
2.7.1
2.7.1.rc1
2.8.0
2.8.0.1
2.8.0.1.rc1
2.8.0.rc1
2.8.0.rc2
2.8.0.rc3
2.8.1
2.8.1.rc2
2.9.0
2.9.0.beta1
2.9.0.beta2
Fixed in
2.9.1
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2012-2139
GHSA-cj92-c4fj-w9c5
Oct 24, 2017
Mail Gem Path Traversal vulnerability
Medium
Directory traversal vulnerability in Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 51 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
Fixed in
2.4.4
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2011-0739
GHSA-cpjc-p7fc-j9xh
Oct 24, 2017
Mail Improper Input Validation vulnerability
Medium
The deliver function in the sendmail delivery agent ( Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 39 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.2
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
Fixed in
2.2.15
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2012-2140
GHSA-rp63-jfmw-532w
Oct 24, 2017
Mail Gem Improper Input Validation vulnerability
High
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 50 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
Fixed in
2.4.3
References
Updated Dec 03, 2024 · Source: OSV.dev
CVE-2015-9097
GHSA-q86f-fmqf-qrf6
Oct 24, 2017
Mail Gem CRLF Injection vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. Affected versions
1.0.0
1.1.0
1.2.1
1.2.5
1.2.6
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
+ 56 more Show less
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.5
2.1.5.1
2.1.5.2
2.1.5.3
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.3
2.2.4
2.2.5
2.2.5.1
2.2.5.2
2.2.6
2.2.6.1
2.2.7
2.2.9
2.2.9.1
2.3.0
2.3.2
2.3.3
2.4.0
2.4.1
2.4.3
2.4.4
2.5.2
2.5.3
2.5.4
2.5.5.rc1
Fixed in
2.5.5
References
Updated Feb 16, 2024 · Source: OSV.dev |