{"action":"Upgrade ruby-mail to 2.6.1+dfsg1-1 or later.","affected":[{"fixed":"2.6.1+dfsg1-1","introduced":"0"}],"component":"ruby-mail","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["2.6.1+dfsg1-1"],"id":"tcs_01M5NBCVVRBEAZAX07APDQ4X6F","modified_at":"2026-09-09T07:02:07.797172003Z","published_at":"2017-06-12T20:29:00.237Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2015-9097","https://security-tracker.debian.org/tracker/CVE-2015-9097"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2015-9097","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2015-9097"}],"summary":"The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences imme"}