🛡️ CVE-2024-47889 — actionmailer

🟡 CVSS 5.0 — Medium ✅ No Known Exploit CWE-1333 NVD

5.0

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

Possible ReDoS vulnerability in block_format in Action Mailer

There is a possible ReDoS vulnerability in the block_format helper in Action Mailer. This vulnerability has been assigned the CVE identifier CVE-2024-47889.

Impact

------

Carefully crafted text can cause the block_format helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires Ruby 3.2 or greater so is unaffected.

Releases

--------

The fixed releases are available at the normal locations.

Workarounds

-----------

Users can avoid calling the block_format helper or upgrade to Ruby 3.2

Credits

-------

Thanks to yuki_osaki for the report!

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. Rated impact: confidentiality none, integrity none, availability high.

Weakness class

CVE-2024-47889 is classified as CWE-1333: Inefficient Regular Expression Complexity. A regular expression backtracks catastrophically on crafted input, consuming CPU out of proportion to input size.

Affected software

CVE-2024-47889 is recorded against 3 packages.

actionmailer (from 7.2.0 up to 7.2.1.1)
rails
unknown

Timeline and source

Published on 15 October 2024 and last revised on 7 January 2025. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

github.com (Web)
github.com (Package)
github.com (Web)

CVE-2024-47889 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Debian Ubuntu

Details

Severity Medium

CVSS Score 5.0

CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

CWE CWE-1333

Public Exploit ✅ No

Source NVD

Published 2024-10-15

Updated 2026-08-12

Modified 2025-01-07

Fix URL N/A

Affected Packages

Software	From version	Fixed in
actionmailer	7.2.0	7.2.1.1
rails	—	—
unknown	—	—

References

WEB https://github.com/rails/rails/security/advisories/GHSA-h47h-mwp9-c6q6

PACKAGE https://github.com/rails/rails

WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionmailer/CVE-2024-47889.yml

🔗 NVD 🔗 Mitre

Similar Threats

Unknown MAL-2024-6385
Unknown MAL-2024-6386

Vulnerability Monitoring

Track new vulnerabilities in actionmailer

CVE-2024-47889 is rated CVSS 5.0 Medium. BotEraser monitors your WordPress installation and notifies you when software you use appears in our vulnerability database.

Set Up Free Alerts →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.