GHSA-mvxr-6m87-mv2q
MediumSummary
A vulnerability in the Mail library affects the q_value_decode and b_value_decode functions, which decode only the first RFC 2047 encoded-word in a string and use an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause incorrect decoding.
Risk Assessment
The risk is that an attacker could exploit this vulnerability to manipulate displayed email addresses, potentially leading to spoofing or bypassing security filters. This could expose the organization to phishing attacks or other fraud based on fake addresses.
Recommendation
It is recommended to immediately update the Mail library to the latest version containing the fix. Also, review application code for usage of q_value_decode and b_value_decode and adapt it to the new behavior.
Other vulnerabilities in Mail
See all- CVE-2017-13874High
An issue was discovered in certain Apple products, including iOS before 11.2, related to the 'Mail' component. It might allow remote attackers to bypass an intended encryption protection mechanism by leveraging incorrect S/MIME certificate selection.
- CVE-2017-13871High
An issue was discovered in certain Apple products, including macOS before 10.13.2, related to the 'Mail' component. It allows remote attackers to read cleartext e-mail content that was intended to be protected by S/MIME encryption.
- CVE-2016-4689High
An issue was discovered in certain Apple products, including iOS before 10.2, related to the 'Mail' component. The issue involves the lack of user alerts for S/MIME email signatures using a revoked certificate.
- CVE-2026-63435Medium
Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.
Original NVD description (English source)
## Summary Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the dec
Vulnerability data from NVD (NIST) · CISA KEV · EPSS