Email address spoofing via malformed RFC 2047 encoded-words in mail
Published: July 01, 2026
SECURITY IDENTIFIERS
- GHSA: GHSA-mvxr-6m87-mv2q
- Vendor Advisory: https://github.com/mikel/mail/security/advisories/GHSA-mvxr-6m87-mv2q
GEM
SEVERITY
CVSS v3.x: 5.1 (Medium)
PATCHED VERSIONS
>= 2.9.1
DESCRIPTION
Summary
Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address.