CVE-2026-63435 in Mail
Summary
by MITRE • 09/02/2026
Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The Mail gem for Ruby serves as a foundational library for handling email generation, parsing, and transmission within the Ruby ecosystem. A critical vulnerability was identified in versions prior to 2.9.1 concerning the implementation of character set decoding utilities, specifically the q_value_decode and b_value_decode methods. These functions are responsible for processing RFC 2047 encoded-words found in email headers such as From, To, and Reply-To. The core technical flaw lies in the use of a single regular expression match with an overly greedy charset capture group. This implementation fails to correctly isolate individual encoded words when multiple or malformed encodings appear within a header field. Consequently, the decoder mishandles surrounding text and subsequent encoded segments, leading to a discrepancy between the raw header values as inspected by human reviewers or downstream parsers and the decoded values processed by the application logic.
This parsing inconsistency creates a significant security risk primarily centered around email spoofing and phishing attacks. Because the decoded display names or local parts can differ from what is visually presented in standard mail clients, an attacker can craft malformed encoded-words that cross question mark delimiters used to separate encoding markers. This allows the creation of header values where the displayed sender information appears legitimate while the underlying envelope sender or routing data differs. Such discrepancies enable attackers to bypass authorization checks that rely on specific header fields for validation, facilitate sophisticated phishing campaigns by masking malicious origins, and potentially exploit trust relationships in systems that do not perform strict canonicalization of email headers before processing.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the application fails to properly validate or sanitize input data during the decoding process. It also relates to CWE-749 Exposed Dangerous Method for Email Spoofing and is relevant to ATT&CK technique T1566 Phishing, specifically regarding the manipulation of email headers to evade detection mechanisms that rely on visual inspection rather than deep packet analysis. The issue underscores the importance of robust parsing logic in security-critical libraries where subtle discrepancies between human-readable formats and machine-parsed data can be exploited for malicious purposes.
The vulnerability has been addressed in version 2.9.1 of the Mail gem, which corrects the decoding algorithms to ensure that encoded words are processed individually without allowing greedy captures to interfere with adjacent text or delimiters. Organizations utilizing this library should immediately upgrade to version 2.9.1 or later to mitigate these risks. Additionally, developers implementing email handling logic should adopt defense-in-depth strategies by validating sender and recipient addresses against expected formats at multiple layers of the application stack rather than relying solely on header display values for security decisions.