CVE-2026-63435: Mail: Email address spoofing via malformed RFC 2047 encoded-words
Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.qvaluedecode and Mail::Utilities.bvaluedecode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mailto a version that resolves this vulnerability.Fixed in 2.9.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using Ruby Mail versions prior to 2.9.1 are affected when they parse email address display names or local parts containing crafted malformed RFC 2047 encoded-words. The issue can affect handling of From, To, and Reply-To headers.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network attack access, low attack complexity, no privileges required, and no user interaction.
What is the remediation?
Upgrade Ruby Mail to version 2.9.1, which fixes the decoding behavior in Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode.
What is the security impact if an application is vulnerable?
A malformed encoded-word can cause decoded address header values to differ from the raw values reviewed by a person or processed by another parser. This can enable apparent sender or recipient spoofing, phishing, or bypasses of authorization checks that rely on those decoded values.