CVE-2026-63435
published 2026-09-01CVE-2026-63435: Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.45%
37.9th percentile
Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | system-rhel8 | — | — |
| 3scale-amp2 | system-rhel9 | — | — |
| 3scale-amp2 | zync-rhel9 | — | — |
| mikel | < 2.9.1 | 2.9.1 | |
| nextcloud | >= 0 < 2.9.1 | 2.9.1 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Mail: Email address spoofing via malformed RFC 2047 encoded-words
ghsa·2026-09-02
CVE-2026-63435 [MEDIUM] CWE-436 Mail: Email address spoofing via malformed RFC 2047 encoded-words
Mail: Email address spoofing via malformed RFC 2047 encoded-words
## Summary
Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address.
## Details
Both decoders used a single String#match against a pattern such as /\=\?(.+)?\?[Qq]\?(.*)\?\=/m. Two problems:
1. Single match, dropped remainder. Only the first =?charset?Q?...?= (or ?B?) word was decoded. Any additional encoded-words or surrounding text were not h
VulDB
Mikel Mail up to 2.9.0 Utilities Utilities.b_value_decode improper authorization
vuldb·2026-09-01·CVSS 5.3
CVE-2026-63435 [MEDIUM] Mikel Mail up to 2.9.0 Utilities Utilities.b_value_decode improper authorization
A vulnerability has been found in Mikel Mail up to 2.9.0 and classified as problematic. This affects the function Mail::Utilities.q_value_decode/Mail::Utilities.b_value_decode of the component Utilities. Performing a manipulation results in improper authorization.
This vulnerability is identified as CVE-2026-63435. The attack can be initiated remotely. There is not any exploit available.
The affected component should be upgraded.
Red Hat
mail: Mail: Email address spoofing via malformed RFC 2047 encoded-words
vendor_redhat·2026-09-01·CVSS 5.3
CVE-2026-63435 [MEDIUM] CWE-1286 mail: Mail: Email address spoofing via malformed RFC 2047 encoded-words
mail: Mail: Email address spoofing via malformed RFC 2047 encoded-words
Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.
A flaw was found in Mail, an inte
No detection rules found.
No public exploits indexed.
2026-09-01
Published