{"id":"CVE-2026-63435","title":"Mail is an internet library for Ruby designed to handle email generation, parsing, and sending","summary":"Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset cap…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-436"],"vendor":"mail","product":"mail","affected":["mail < 2.9.1"],"patched":["mail 2.9.1"],"published":"2026-09-01","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63435","references":[{"url":"https://github.com/mikel/mail/commit/f9d59c2e447af42e2c3dec5a56b1bb25c7292859","label":"security-advisories@github.com"},{"url":"https://github.com/mikel/mail/pull/1664","label":"security-advisories@github.com"},{"url":"https://github.com/mikel/mail/releases/tag/2.9.1","label":"security-advisories@github.com"},{"url":"https://github.com/mikel/mail/security/advisories/GHSA-mvxr-6m87-mv2q","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63435"},{"url":"https://github.com/advisories/GHSA-mvxr-6m87-mv2q"}],"tags":["nvd","ghsa","rubygems"],"epss":0.00328,"epssPercentile":0.26095,"aliases":["GHSA-mvxr-6m87-mv2q"],"ecosystem":"rubygems","ingestedAt":"2026-09-02T22:51:44.506Z","slug":"CVE-2026-63435","body":"## Overview\n\nMail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-63435)\n\nAffected packages:\n\n- `mail < 2.9.1`\n\nPatched in:\n\n- `mail 2.9.1`\n\nSource: https://github.com/advisories/GHSA-mvxr-6m87-mv2q","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}