Executive brief
The mail Ruby library contains a flaw in how it decodes email header fields (From, To, Reply-To, etc.) that follow the RFC 2047 standard for internationalized text. An attacker can craft a malformed email header that decodes differently than expected, allowing the spoofing of sender or recipient addresses. This could be exploited in phishing attacks or to bypass email validation checks that applications rely on for authorization decisions.
Technical details
The vulnerability exists in Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode methods, which decode RFC 2047 encoded-word format (e.g., =?charset?Q?encoded-text?=) used in email headers. Two parsing flaws combine to create a spoofing vector: (1) the decoders use a single regex match that only processes the first encoded-word and ignores subsequent ones, silently dropping or altering parts of the input; and (2) the regex pattern uses a greedy character class (.+)? that matches across delimiter characters, allowing a malformed encoded-word to span further than RFC 2047 specifies, shifting the boundary between encoded and literal text. An attacker can embed a crafted, malformed encoded-word in a display name or local part of an email address, causing applications using mail to parse and present the decoded result to show a different address than what a validator inspecting the raw header would see. The primary risk is phishing and authorization bypass; no code execution is possible. A patch is available in version 2.9.1.
Affected products
- mikel mail < 2.9.1
Timeline
- 2026-07-01: disclosed
- 2026-07-01: patched: version 2.9.1 released
- 2026-09-02: advisory