CVE-2026-63435Mail: Email address spoofing via malformed RFC 2047 encoded-words
Updated under an hour ago ()
Does this affect you?
It affects mikel mail. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.
- CVSS
- 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness (CWE)
- CWE-436
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- Sep 2, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
mikel mail mikel:mail (from the name) | before 2.9.1 | CNA record |
References
- https://github.com/mikel/mail/security/advisories/GHSA-mvxr-6m87-mv2qx-refsource-confirm
- https://github.com/mikel/mail/pull/1664x-refsource-misc
- https://github.com/mikel/mail/commit/f9d59c2e447af42e2c3dec5a56b1bb25c7292859x-refsource-misc
- https://github.com/mikel/mail/releases/tag/2.9.1x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.