{"id":"CVE-2026-63435","aliases":["DEBIAN-CVE-2026-63435","EUVD-2026-69609","GHSA-mvxr-6m87-mv2q","OESA-2026-4104","OESA-2026-4105","OESA-2026-4106","UBUNTU-CVE-2026-63435"],"status":"published","title":"Mail: Email address spoofing via malformed RFC 2047 encoded-words","description":"Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00448,"percentile":0.39424,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-436"],"published":"2026-09-01T20:09:20Z","modified":"2026-10-28T02:30:53Z","fixes":[{"ecosystem":"RubyGems","package":"mail","fixed_in":["2.9.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"ruby-mail","fixed_in":["2.9.1-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"rubygem-mail","fixed_in":["2.8.1-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"rubygem-mail","fixed_in":["2.8.1-2.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"rubygem-mail","fixed_in":["2.8.1-2.oe2403sp4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1+dfsg1-2","2.8.1+dfsg1-1","2.8.1+dfsg1-2","2.9.0+dfsg1-1","2.9.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.1+dfsg1-2","2.9.0+dfsg1-1","2.9.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-1"}]}],"versions":["2.8.1+dfsg1-2","2.9.0+dfsg1-1"]},{"source":"osv","ecosystem":"RubyGems","package":"mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1"}]}],"versions":["1.0.0","1.1.0","1.2.1","1.2.5","1.2.6","1.2.8","1.2.9","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.4.0","1.4.1","1.4.2","1.4.3","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.6.0","2.0.3","2.0.5","2.1.0","2.1.1","2.1.2","2.1.3","2.1.5","2.1.5.1","2.1.5.2","2.1.5.3","2.2.0","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","2.2.18","2.2.19","2.2.2","2.2.20","2.2.3","2.2.4","2.2.5","2.2.5.1","2.2.5.2","2.2.6","2.2.6.1","2.2.7","2.2.9","2.2.9.1","2.3.0","2.3.2","2.3.3","2.4.0","2.4.1","2.4.3","2.4.4","2.5.2","2.5.3","2.5.4","2.5.5","2.5.5.rc1","2.6.0","2.6.1","2.6.3","2.6.4","2.6.4.rc1","2.6.4.rc2","2.6.5","2.6.5.rc1","2.6.6","2.6.6.rc1","2.7.0","2.7.0.rc1","2.7.0.rc2","2.7.0.rc3","2.7.1","2.7.1.rc1","2.8.0","2.8.0.1","2.8.0.1.rc1","2.8.0.rc1","2.8.0.rc2","2.8.0.rc3","2.8.1","2.8.1.rc2","2.9.0","2.9.0.beta1","2.9.0.beta2"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"rubygem-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"rubygem-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"rubygem-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-2.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.6-5ubuntu1","1.5.6-6","1.5.6-7","1.5.6-9+deb8u2build0.14.04.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby2.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0-1","2.3.0-2","2.3.0-4ubuntu2","2.3.0-4ubuntu3","2.3.0-5ubuntu1","2.3.1-2~16.04","2.3.1-2~16.04.2","2.3.1-2~16.04.4","2.3.1-2~16.04.5","2.3.1-2~16.04.6","2.3.1-2~16.04.7","2.3.1-2~16.04.9","2.3.1-2~16.04.10","2.3.1-2~16.04.11","2.3.1-2~16.04.12","2.3.1-2~ubuntu16.04.13","2.3.1-2~ubuntu16.04.14","2.3.1-2~ubuntu16.04.15","2.3.1-2~ubuntu16.04.16","2.3.1-2~ubuntu16.04.16+esm1","2.3.1-2~ubuntu16.04.16+esm2","2.3.1-2~ubuntu16.04.16+esm3","2.3.1-2~ubuntu16.04.16+esm4","2.3.1-2~ubuntu16.04.16+esm5","2.3.1-2~ubuntu16.04.16+esm6","2.3.1-2~ubuntu16.04.16+esm7","2.3.1-2~ubuntu16.04.16+esm8","2.3.1-2~ubuntu16.04.16+esm9","2.3.1-2~ubuntu16.04.16+esm10","2.3.1-2~ubuntu16.04.16+esm11","2.3.1-2~ubuntu16.04.16+esm12","2.3.1-2~ubuntu16.04.16+esm14","2.3.1-2~ubuntu16.04.16+esm15"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.21-2ubuntu4","1.7.22-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.0~preview1-1ubuntu2","2.5.0-4ubuntu1","2.5.0-4ubuntu4","2.5.0-5ubuntu1","2.5.0-6ubuntu1","2.5.1-1ubuntu1","2.5.1-1ubuntu1.1","2.5.1-1ubuntu1.2","2.5.1-1ubuntu1.4","2.5.1-1ubuntu1.5","2.5.1-1ubuntu1.6","2.5.1-1ubuntu1.7","2.5.1-1ubuntu1.8","2.5.1-1ubuntu1.9","2.5.1-1ubuntu1.10","2.5.1-1ubuntu1.11","2.5.1-1ubuntu1.12","2.5.1-1ubuntu1.13","2.5.1-1ubuntu1.14","2.5.1-1ubuntu1.15","2.5.1-1ubuntu1.16","2.5.1-1ubuntu1.16+esm1","2.5.1-1ubuntu1.16+esm3","2.5.1-1ubuntu1.16+esm4","2.5.1-1ubuntu1.16+esm5","2.5.1-1ubuntu1.16+esm6","2.5.1-1ubuntu1.16+esm7","2.5.1-1ubuntu1.16+esm8"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.1.13.0-1","9.1.17.0-1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.0-1","2.7.0-2","2.7.0-3","2.7.0-4","2.7.0-4ubuntu1","2.7.0-5ubuntu1","2.7.0-5ubuntu1.1","2.7.0-5ubuntu1.2","2.7.0-5ubuntu1.3","2.7.0-5ubuntu1.4","2.7.0-5ubuntu1.5","2.7.0-5ubuntu1.6","2.7.0-5ubuntu1.7","2.7.0-5ubuntu1.8","2.7.0-5ubuntu1.9","2.7.0-5ubuntu1.10","2.7.0-5ubuntu1.11","2.7.0-5ubuntu1.12","2.7.0-5ubuntu1.13","2.7.0-5ubuntu1.14","2.7.0-5ubuntu1.15","2.7.0-5ubuntu1.16","2.7.0-5ubuntu1.17","2.7.0-5ubuntu1.18","2.7.0-5ubuntu1.18+esm1","2.7.0-5ubuntu1.18+esm3","2.7.0-5ubuntu1.18+esm4","2.7.0-5ubuntu1.18+esm5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.1.17.0-3","9.1.17.0-3build5","9.1.17.0-3build6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-5ubuntu1","3.0.2-7","3.0.2-7ubuntu2","3.0.2-7ubuntu2.1","3.0.2-7ubuntu2.2","3.0.2-7ubuntu2.3","3.0.2-7ubuntu2.4","3.0.2-7ubuntu2.5","3.0.2-7ubuntu2.6","3.0.2-7ubuntu2.7","3.0.2-7ubuntu2.8","3.0.2-7ubuntu2.10","3.0.2-7ubuntu2.11","3.0.2-7ubuntu2.12","3.0.2-7ubuntu2.13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.3.9.0+ds-1","9.4.5.0+ds-1","9.4.5.0+ds-1ubuntu1","9.4.6.0+ds-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby3.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.3-1","3.2.3-1build2","3.2.3-1build3","3.2.3-1ubuntu0.24.04.1","3.2.3-1ubuntu0.24.04.3","3.2.3-1ubuntu0.24.04.5","3.2.3-1ubuntu0.24.04.6","3.2.3-1ubuntu0.24.04.7","3.2.3-1ubuntu0.24.04.8"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.8.0+ds-3ubuntu1","9.4.14.0+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ruby3.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.8-2ubuntu3","3.3.8-2.2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.8.0+ds-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ruby3.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.8-2ubuntu2","3.3.8-2ubuntu3","3.3.8-2ubuntu3.1"]}],"products":[{"vendor":"mikel","product":"mail"},{"vendor":"nextcloud","product":"mail"}],"references":[{"url":"https://github.com/mikel/mail/security/advisories/GHSA-mvxr-6m87-mv2q","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/mikel/mail/pull/1664","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/mikel/mail/commit/f9d59c2e447af42e2c3dec5a56b1bb25c7292859","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/mikel/mail/releases/tag/2.9.1","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63435","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mvxr-6m87-mv2q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63435.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-63435","tags":["advisory"]},{"url":"https://github.com/mikel/mail","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4104","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4105","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4106","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-63435","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63435","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-63435","title":"Mail: Email address spoofing via malformed RFC 2047 encoded-words","description":"Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.","status":"published","published":"2026-09-01T20:09:20.82Z","modified":"2026-09-02T15:44:56.368Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-69609","description":"Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.","status":"published","published":"2026-09-01T20:09:20Z","modified":"2026-09-02T15:44:56Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:15.49101Z"}],"ghsa":[{"id":"GHSA-mvxr-6m87-mv2q","title":"Mail: Email address spoofing via malformed RFC 2047 encoded-words","description":"## Summary\n\nMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address.\n\n## Details\n\nBoth decoders used a single String#match against a pattern such as /\\=\\?(.+)?\\?[Qq]\\?(.*)\\?\\=/m. Two problems:\n\n1. Single match, dropped remainder. Only the first =?charset?Q?...?= (or ?B?) word was decoded. Any additional encoded-words or surrounding text were not handled consistently, so the decoded result could silently omit or alter parts of the input.\n2. Greedy charset capture. (.+)? is greedy and matches across ? delimiters, so a malformed word could span more of the string than a strict RFC 2047 parse would, changing the boundary between \"encoded\" and \"literal\" text.\n\n## Impact\n\nApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE.","status":"published","published":"2026-09-02T22:02:32Z","modified":"2026-09-02T22:02:33Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:41:11.621873Z"}],"nvd":[{"id":"CVE-2026-63435","description":"Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.","status":"published","published":"2026-09-01T21:18:35.287Z","modified":"2026-09-09T21:09:13.08Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:12:43.04945Z"}],"osv":[{"id":"CVE-2026-63435","title":"Mail: Email address spoofing via malformed RFC 2047 encoded-words","description":"Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.","status":"published","published":"2026-09-01T20:09:20.82Z","modified":"2026-10-28T02:30:53.321039813Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"DEBIAN-CVE-2026-63435","description":"Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.","status":"published","published":"2026-09-01T21:18:35.287Z","modified":"2026-10-01T03:03:29.473124948Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"GHSA-mvxr-6m87-mv2q","title":"Mail: Email address spoofing via malformed RFC 2047 encoded-words","description":"## Summary\n\nMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address.\n\n## Details\n\nBoth decoders used a single String#match against a pattern such as /\\=\\?(.+)?\\?[Qq]\\?(.*)\\?\\=/m. Two problems:\n\n1. Single match, dropped remainder. Only the first =?charset?Q?...?= (or ?B?) word was decoded. Any additional encoded-words or surrounding text were not handled consistently, so the decoded result could silently omit or alter parts of the input.\n2. Greedy charset capture. (.+)? is greedy and matches across ? delimiters, so a malformed word could span more of the string than a strict RFC 2047 parse would, changing the boundary between \"encoded\" and \"literal\" text.\n\n## Impact\n\nApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE.","status":"published","published":"2026-09-02T22:02:32Z","modified":"2026-09-10T03:50:54.686601853Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"OESA-2026-4104","title":"rubygem-mail security update","description":"A really Ruby Mail handler.\r\n\r\nSecurity Fix(es):\n\nAffected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through `q_value_decode` and `b_value_decode` in `lib/mail/utilities.rb`. An attacker can make a display name or local part decode to a different address than intended by supplying a malformed RFC 2047 encoded-word, including one that embeds extra encoded-word markers or additional text. The decoders only matched the first encoded-word and used a greedy charset capture, so a crafted header could cause the parsed `From`, `To`, or `Reply-To` value to omit or reshuffle literal text. Applications that display, compare, or authorize based on the decoded address can then present or act on a spoofed sender or recipient address.(CVE-2026-63435)","status":"published","published":"2026-09-25T01:28:27Z","modified":"2026-09-25T01:45:13.763754073Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4105","title":"rubygem-mail security update","description":"A really Ruby Mail handler.\r\n\r\nSecurity Fix(es):\n\nAffected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through `q_value_decode` and `b_value_decode` in `lib/mail/utilities.rb`. An attacker can make a display name or local part decode to a different address than intended by supplying a malformed RFC 2047 encoded-word, including one that embeds extra encoded-word markers or additional text. The decoders only matched the first encoded-word and used a greedy charset capture, so a crafted header could cause the parsed `From`, `To`, or `Reply-To` value to omit or reshuffle literal text. Applications that display, compare, or authorize based on the decoded address can then present or act on a spoofed sender or recipient address.(CVE-2026-63435)","status":"published","published":"2026-09-25T01:28:27Z","modified":"2026-09-25T01:45:13.76823801Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4106","title":"rubygem-mail security update","description":"A really Ruby Mail handler.\r\n\r\nSecurity Fix(es):\n\nAffected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through `q_value_decode` and `b_value_decode` in `lib/mail/utilities.rb`. An attacker can make a display name or local part decode to a different address than intended by supplying a malformed RFC 2047 encoded-word, including one that embeds extra encoded-word markers or additional text. The decoders only matched the first encoded-word and used a greedy charset capture, so a crafted header could cause the parsed `From`, `To`, or `Reply-To` value to omit or reshuffle literal text. Applications that display, compare, or authorize based on the decoded address can then present or act on a spoofed sender or recipient address.(CVE-2026-63435)","status":"published","published":"2026-09-25T01:28:27Z","modified":"2026-09-25T01:45:13.118240899Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2026-63435","description":"Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.","status":"published","published":"2026-09-01T21:18:00Z","modified":"2026-10-17T13:00:32.808836981Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:43.630667Z"}]}}