CVE-2026-63435: Mail: Email address spoofing via malformed RFC 2047 encoded-words
Summary
Mail::Utilities.qvaluedecode and Mail::Utilities.bvaluedecode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address.
Details
Both decoders used a single String#match against a pattern such as /\=\?(.+)?\?[Qq]\?(.)\?\=/m. Two problems:
1. Single match, dropped remainder. Only the first =?charset?Q?...?= (or ?B?) word was decoded. Any additional encoded-words or surrounding text were not handled consistently, so the decoded result could silently omit or alter parts of the input. 2. Greedy charset capture. (.+)? is greedy and matches across ? delimiters, so a malformed word could span more of the string than a strict RFC 2047 parse would, changing the boundary between "encoded" and "literal" text.
Impact
Applications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE.
Other sources
Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.qvaluedecode and Mail::Utilities.bvaluedecode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/mailto a version that resolves this vulnerability.Fixed in 2.9.1 - Upgrade
Upgrade
Mailto a version that resolves this vulnerability.Fixed in 2.9.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using Ruby Mail versions prior to 2.9.1 are affected when they parse email address display names or local parts containing crafted malformed RFC 2047 encoded-words. The issue can affect handling of From, To, and Reply-To headers.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network attack access, low attack complexity, no privileges required, and no user interaction.
What is the remediation?
Upgrade Ruby Mail to version 2.9.1, which fixes the decoding behavior in Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode.
What is the security impact if an application is vulnerable?
A malformed encoded-word can cause decoded address header values to differ from the raw values reviewed by a person or processed by another parser. This can enable apparent sender or recipient spoofing, phishing, or bypasses of authorization checks that rely on those decoded values.