Email address spoofing via malformed RFC 2047 encoded-words in mail
Published: July 01, 2026
SECURITY IDENTIFIERS
- CVE: CVE-2026-63435 (NVD)
- GHSA: GHSA-mvxr-6m87-mv2q
- Vendor Advisory: https://github.com/mikel/mail/security/advisories/GHSA-mvxr-6m87-mv2q
GEM
SEVERITY
CVSS v3.x: 5.3 (Medium)
PATCHED VERSIONS
>= 2.9.1
DESCRIPTION
Summary
Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address.
RELATED
- https://nvd.nist.gov/vuln/detail/cve-2026-63435
- https://rubygems.org/gems/mail/versions/2.9.1
- https://github.com/mikel/mail/releases/tag/2.9.1
- https://github.com/mikel/mail/pull/1664
- https://github.com/mikel/mail/commit/f9d59c2e447af42e2c3dec5a56b1bb25c7292859
- https://osv.dev/vulnerability/GHSA-mvxr-6m87-mv2q
- https://advisories.gitlab.com/gem/mail/CVE-2026-63435
- https://github.com/mikel/mail/security/advisories/GHSA-mvxr-6m87-mv2q
- https://github.com/advisories/GHSA-mvxr-6m87-mv2q