RubyGems/mail CVE-2026-63435: medium 5.3, EPSS 0.45%

Mail: Email address spoofing via malformed RFC 2047 encoded-words

Action: Upgrade mail to 2.9.1 or later.

bundle update mail

Affected

Fixed versions

Sources

• osv: GHSA-mvxr-6m87-mv2q
• https://github.com/mikel/mail/security/advisories/GHSA-mvxr-6m87-mv2q
• https://nvd.nist.gov/vuln/detail/CVE-2026-63435
• https://github.com/mikel/mail/pull/1664
• https://github.com/mikel/mail/commit/f9d59c2e447af42e2c3dec5a56b1bb25c7292859
• https://github.com/mikel/mail
• https://github.com/mikel/mail/releases/tag/2.9.1

CVE-2026-63435 · published 2026-09-02T22:02:32Z · modified 2026-09-10T03:50:54.686601853Z · JSON