Mail: Email address spoofing via malformed RFC 2047 encoded-words — GHSA-MVXR-6M87-MV2Q

Summary

## Summary Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the…

Timeline

Published by source

2026-09-02

Risk context

• Reported severity or threat level: medium.
• Reported CVSS score: 5.3 out of 10.
• Review exposure for the affected product or family: rubygems: mail.

Product

rubygems: mail

What to do

General, cautious steps (verify details in the official source):

• Review exposure and plan remediation based on risk and environment.
• Identify affected product versions in your inventory and verify whether you are impacted.
• Apply vendor patches/updates or recommended mitigations as soon as available.
• Read the official advisory for exact affected versions and remediation steps.

Official advisory

• Read the official source
• CVE Record
• NVD

Evidence and provenance

Canonical advisory ID

GHSA-MVXR-6M87-MV2Q

Source

GitHub

Vendor

GitHub

Published by source

2026-09-02

Last source activity

2026-09-02

Additional identifiers

CVE-2026-63435

Curated by

hlukh.ch

Related advisories and connections

These advisories are connected by shared CVE, product, vendor, source, or time signals.