CVE-2026-63435

Name of the Vulnerable Software and Affected Versions Mail versions prior to 2.9.1

Description Mail is an internet library for Ruby used for email generation, parsing, and sending. The functions q value decode() and b value decode() within Mail::Utilities use a single String#match and an overly greedy charset capture. This causes the library to decode only the first RFC 2047 encoded-word and mishandle subsequent or surrounding text. An attacker can use a crafted malformed encoded-word in a local part or address display name to cross ? delimiters. This results in decoded From, To, or Reply-To header values that differ from the raw values, which can lead to sender or recipient spoofing, phishing, or the bypass of authorization checks.

Recommendations Update to version 2.9.1.