CVE-2026-63435: Mail: Email address spoofing via malformed RFC 2047 encoded-words

September 2, 2026

Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address.

References

github.com/advisories/GHSA-mvxr-6m87-mv2q
github.com/mikel/mail/commit/f9d59c2e447af42e2c3dec5a56b1bb25c7292859
github.com/mikel/mail/pull/1664
github.com/mikel/mail/releases/tag/2.9.1
github.com/mikel/mail/security/advisories/GHSA-mvxr-6m87-mv2q
nvd.nist.gov/vuln/detail/CVE-2026-63435

Code Behaviors & Features

Detect and mitigate CVE-2026-63435 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →