CVE-2026-63435: Ruby Mail Library Authentication Bypass Flaw

CVE-2026-63435 Overview

CVE-2026-63435 affects the Ruby Mail library, an internet library designed to handle email generation, parsing, and sending. Versions prior to 2.9.1 mishandle RFC 2047 encoded-word decoding in Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode. A crafted malformed encoded-word in an address display name or local part can cross ? delimiters. This causes decoded From, To, or Reply-To header values to diverge from the raw values a human reviewer or downstream parser inspects. The mismatch enables apparent sender or recipient spoofing, phishing, and authorization-check bypass. The issue is fixed in version 2.9.1 and classified as [CWE-436] Interpretation Conflict.

Critical Impact

Attackers can craft email headers that display one sender or recipient to human reviewers and downstream parsers while decoding to a different identity, enabling phishing and authorization bypass in applications relying on decoded header values.

Affected Products

• Ruby mail gem versions prior to 2.9.1
• Applications using Mail::Utilities.q_value_decode for RFC 2047 Q-encoded header parsing
• Applications using Mail::Utilities.b_value_decode for RFC 2047 B-encoded header parsing

Discovery Timeline

• 2026-09-01 - CVE-2026-63435 published to NVD
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-63435

Vulnerability Analysis

The mail gem implements RFC 2047 encoded-word decoding to parse international character sets in email headers. Encoded-words follow the format =?charset?encoding?encoded-text?=, where encoding is either Q (quoted-printable) or B (base64). The vulnerable decoders used a single String#match operation with an overly greedy charset capture pattern. This design decoded only the first encoded-word in a string and mishandled surrounding or subsequent text.

When an attacker crafts a malformed encoded-word, the regex can consume ? delimiters that should have terminated the charset field or encoded payload. The resulting decoded string differs from what a human reviewer sees in the raw header. Applications that trust decoded header values for identity checks, spam filtering, or access control become vulnerable to spoofing.

Root Cause

The root cause lies in the regular expression patterns /\=\?(.+)?\?[Bb]\?(.*)\?\=/m and the equivalent Q-decoder pattern. The .+ and .* quantifiers are greedy and match across ? characters, violating the RFC 2047 grammar. The decoder also processed only the first match, leaving subsequent encoded-words and interleaved literal text handled inconsistently.

Attack Vector

An attacker sends an email with a crafted From, To, or Reply-To header containing a malformed encoded-word in the display name or local part. The raw header is visible to security reviewers or logging systems, while parsers using the vulnerable mail gem decode the header to a different identity. This interpretation conflict can bypass sender-based authorization checks and enable phishing campaigns.

# Patch from lib/mail/utilities.rb - Improve decoding of Q- and B-encoded strings

def Utilities.b_value_decode(str)
  # OLD (vulnerable):
  # match = str.match(/\=\?(.+)?\?[Bb]\?(.*)\?\=/m)
  # if match
  #   charset = match[1]
  #   str = Utilities.decode_base64(match[2])
  #   str = charset_encoder.encode(str, charset)
  # end

  # NEW (fixed): iterate all encoded-words with a non-greedy, delimiter-safe pattern
  b_decoded = str.gsub(/=\?([^?]+)\?[Bb]\?([^?]*)\?=/m) do |match|
    charset = $1
    string = Utilities.decode_base64($2)

    begin
      charset_encoder.encode(string, charset)
    rescue Encoding::UndefinedConversionError, ArgumentError,
           Encoding::ConverterNotFoundError, Encoding::InvalidByteSequenceError
      warn "WARNING: Encoding conversion failed #{$!}"
      string.dup.force_encoding(Encoding::UTF_8)
    end
  end
end

Source: GitHub Commit f9d59c2. The patch replaces .+ and .* with [^?]+ and [^?]* character classes that stop at ? delimiters, and switches from single-match String#match to String#gsub to process all encoded-words in the input.

Detection Methods for CVE-2026-63435

Indicators of Compromise

• Inbound email headers containing malformed RFC 2047 encoded-words with unbalanced ? delimiters in From, To, Reply-To, or Cc fields
• Discrepancies between raw header values in mail transfer agent logs and decoded values reported by application code
• Multiple encoded-word tokens interleaved with literal text in address display names or local parts

Detection Strategies

• Compare raw headers captured at the mail transfer agent with the decoded values used by downstream Ruby applications and alert on mismatches
• Perform static analysis of Ruby codebases to identify direct or transitive use of Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode at versions below 2.9.1
• Deploy a lint or CI check that flags dependencies on the mail gem below version 2.9.1 in Gemfile.lock

Monitoring Recommendations

• Ingest mail server and application logs into a centralized data lake and correlate raw versus decoded address fields for anomaly identification
• Monitor authentication and authorization decisions that rely on decoded email addresses for unexpected identity transitions
• Alert on parser warnings emitted by the patched decoder, including WARNING: Encoding conversion failed, which can indicate crafted input

How to Mitigate CVE-2026-63435

Immediate Actions Required

• Upgrade the mail gem to version 2.9.1 or later in all Ruby applications and rebuild Gemfile.lock
• Audit any authorization logic or trust decisions that consume decoded values from From, To, Reply-To, or Cc headers
• Redeploy dependent services after the upgrade so long-running processes load the patched library into memory

Patch Information

The fix is available in mail gem version 2.9.1. Refer to the GitHub Release 2.9.1, the GitHub Pull Request #1664, and the GitHub Security Advisory GHSA-mvxr-6m87-mv2q for full technical context.

Workarounds

• Perform identity checks against raw header bytes rather than decoded values until the upgrade is deployed
• Reject inbound messages whose address headers contain malformed RFC 2047 tokens with unbalanced ? delimiters at the mail gateway
• Normalize and re-validate decoded addresses against a strict RFC 5322 address grammar before using them in trust decisions

# Upgrade the mail gem to the patched release
bundle update mail --conservative

# Verify the installed version is 2.9.1 or later
bundle info mail | grep -i version

# Confirm the resolved dependency in Gemfile.lock
grep -E "^\s+mail \(" Gemfile.lock