GHSA-mvxr-6m87-mv2q

A vulnerability in the Mail library affects the q_value_decode and b_value_decode functions, which decode only the first RFC 2047 encoded-word in a string and use an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause incorrect decoding.

The risk is that an attacker could exploit this vulnerability to manipulate displayed email addresses, potentially leading to spoofing or bypassing security filters. This could expose the organization to phishing attacks or other fraud based on fake addresses.

It is recommended to immediately update the Mail library to the latest version containing the fix. Also, review application code for usage of q_value_decode and b_value_decode and adapt it to the new behavior.