Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:gem/actionmailer@8.0.0.beta1
purl pkg:gem/actionmailer@8.0.0.beta1
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-yy6t-ybeu-qycc
Aliases:
CVE-2024-47889
GHSA-h47h-mwp9-c6q6
Possible ReDoS vulnerability in block_format in Action Mailer There is a possible ReDoS vulnerability in the block_format helper in Action Mailer. This vulnerability has been assigned the CVE identifier CVE-2024-47889. Impact ------ Carefully crafted text can cause the block_format helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires Ruby 3.2 or greater so is unaffected. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- Users can avoid calling the `block_format` helper or upgrade to Ruby 3.2 Credits ------- Thanks to yuki_osaki for the report! There are no reported fixed by versions.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-yy6t-ybeu-qycc Possible ReDoS vulnerability in block_format in Action Mailer There is a possible ReDoS vulnerability in the block_format helper in Action Mailer. This vulnerability has been assigned the CVE identifier CVE-2024-47889. Impact ------ Carefully crafted text can cause the block_format helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires Ruby 3.2 or greater so is unaffected. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- Users can avoid calling the `block_format` helper or upgrade to Ruby 3.2 Credits ------- Thanks to yuki_osaki for the report! CVE-2024-47889
GHSA-h47h-mwp9-c6q6

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-16T23:12:00.158434+00:00 GitLab Importer Fixing VCID-yy6t-ybeu-qycc https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/actionmailer/CVE-2024-47889.yml 38.4.0
2026-04-16T17:41:09.027653+00:00 Ruby Importer Fixing VCID-yy6t-ybeu-qycc https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionmailer/CVE-2024-47889.yml 38.4.0
2026-04-16T17:41:07.345531+00:00 Ruby Importer Affected by VCID-yy6t-ybeu-qycc https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionmailer/CVE-2024-47889.yml 38.4.0
2026-04-12T00:30:27.015357+00:00 GitLab Importer Fixing VCID-yy6t-ybeu-qycc https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/actionmailer/CVE-2024-47889.yml 38.3.0
2026-04-11T21:38:39.924098+00:00 Ruby Importer Fixing VCID-yy6t-ybeu-qycc https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionmailer/CVE-2024-47889.yml 38.3.0
2026-04-11T21:38:35.932958+00:00 Ruby Importer Affected by VCID-yy6t-ybeu-qycc https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionmailer/CVE-2024-47889.yml 38.3.0
2026-04-03T00:38:06.101730+00:00 GitLab Importer Fixing VCID-yy6t-ybeu-qycc https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/actionmailer/CVE-2024-47889.yml 38.1.0
2026-04-02T19:36:33.564066+00:00 Ruby Importer Fixing VCID-yy6t-ybeu-qycc https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionmailer/CVE-2024-47889.yml 38.1.0
2026-04-02T19:36:30.162114+00:00 Ruby Importer Affected by VCID-yy6t-ybeu-qycc https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionmailer/CVE-2024-47889.yml 38.1.0
2026-04-01T15:53:46.849737+00:00 Ruby Importer Fixing VCID-yy6t-ybeu-qycc https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionmailer/CVE-2024-47889.yml 38.0.0
2026-04-01T15:53:42.997548+00:00 Ruby Importer Affected by VCID-yy6t-ybeu-qycc https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionmailer/CVE-2024-47889.yml 38.0.0