Ruby Mail Library Vulnerability in Email Utilities

CVE-2026-63435

What is CVE-2026-63435?

The Ruby Mail library versions before 2.9.1 contain a vulnerability in the Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode methods. This flaw is caused by an overly greedy charset capture during the decoding process of RFC 2047 encoded-words, resulting in improper handling of address display names or local parts. A specially crafted malformed encoded-word can exploit this issue, allowing decoded header values—including From, To, or Reply-To—to differ significantly from their raw representations. This discrepancy may lead to sender or recipient spoofing, facilitating phishing attacks or enabling unauthorized access by bypassing authentication checks.

References