---
id: CVE-2026-63435
title: >-
  Mail is an internet library for Ruby designed to handle email generation,
  parsing, and sending
summary: >-
  Mail is an internet library for Ruby designed to handle email generation,
  parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and
  Mail::Utilities.b_value_decode used a single String#match and an overly greedy
  charset cap…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-436
vendor: mail
product: mail
affected:
  - mail < 2.9.1
patched:
  - mail 2.9.1
published: '2026-09-01'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63435'
references:
  - url: >-
      https://github.com/mikel/mail/commit/f9d59c2e447af42e2c3dec5a56b1bb25c7292859
    label: security-advisories@github.com
  - url: 'https://github.com/mikel/mail/pull/1664'
    label: security-advisories@github.com
  - url: 'https://github.com/mikel/mail/releases/tag/2.9.1'
    label: security-advisories@github.com
  - url: 'https://github.com/mikel/mail/security/advisories/GHSA-mvxr-6m87-mv2q'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63435'
  - url: 'https://github.com/advisories/GHSA-mvxr-6m87-mv2q'
tags:
  - nvd
  - ghsa
  - rubygems
epss: 0.00448
epssPercentile: 0.36308
aliases:
  - GHSA-mvxr-6m87-mv2q
ecosystem: rubygems
ingestedAt: '2026-09-02T22:51:44.506Z'
---

## Overview

Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-63435)

Affected packages:

- `mail < 2.9.1`

Patched in:

- `mail 2.9.1`

Source: https://github.com/advisories/GHSA-mvxr-6m87-mv2q