CVE-2026-63435: Mail: Email address spoofing via malformed RFC 2047 encoded-words

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-01 · updated 2026-09-09
Weakness: CWE-436

Description

Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.

Affected products

Rubygems Mail: before 2.9.1; 1.0.0, 1.1.0, 1.2.1, 1.2.5, 1.2.6, 1.2.8 (+90) — fixed in 2.9.1
mikel mail: before 2.9.1

How to fix

Upgrade to a fixed version: Rubygems Mail 2.9.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-63435 or the next vulnerability affects your stack