CVE-2026-63435: mail email address spoofing via malformed RFC 2047 encoded-words

CVE-2026-63435 · Severity: medium · CVSS 5.3 · Published 2026-09-01

The mail Ruby library contains a flaw in how it decodes email header fields (From, To, Reply-To, etc.) that follow the RFC 2047 standard for internationalized text. An attacker can craft a malformed email header that decodes differently than expected, allowing the spoofing of sender or recipient addresses. This could be exploited in phishing attacks or to bypass email validation checks that applications rely on for authorization decisions.

Technologies: mail (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-63435 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63435 being exploited in the wild.
How severe is CVE-2026-63435?
Medium severity, with a CVSS score of 5.3, published 1 September 2026.
Which products and versions are affected?
Mikel Mail < 2.9.1; mail (RubyGems) < 2.9.1, ECOSYSTEM:introduced=0,fixed=2.9.1.
Is there a fix for CVE-2026-63435?
Yes. mail (RubyGems): upgrade to 2.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63435 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63435?
Check whether you run Mikel Mail or mail (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mail (RubyGems): upgrade to 2.9.1 or later
    bundle update mail

Technical details

The vulnerability exists in Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode methods, which decode RFC 2047 encoded-word format (e.g., =?charset?Q?encoded-text?=) used in email headers. Two parsing flaws combine to create a spoofing vector: (1) the decoders use a single regex match that only processes the first encoded-word and ignores subsequent ones, silently dropping or altering parts of the input; and (2) the regex pattern uses a greedy character class (.+)? that matches across delimiter characters, allowing a malformed encoded-word to span further than RFC 2047 specifies, shifting the boundary between encoded and literal text. An attacker can embed a crafted, malformed encoded-word in a display name or local part of an email address, causing applications using mail to parse and present the decoded result to show a different address than what a validator inspecting the raw header would see. The primary risk is phishing and authorization bypass; no code execution is possible. A patch is available in version 2.9.1.

Affected products

  • mikel mail < 2.9.1

Identifiers

  • CVE-2026-63435
  • GHSA-mvxr-6m87-mv2q

Timeline

  • 2026-07-01: disclosed
  • 2026-07-01: patched: version 2.9.1 released
  • 2026-09-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.