EUVD-2026-69609
GHSA-mvxr-6m87-mv2q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-delivered via email, no auth or user interaction required by the parser; integrity impact is low (header value manipulation, not arbitrary write).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle surrounding or subsequent text. A crafted malformed encoded-word in an address display name or local part could cross ? delimiters and make decoded From, To, or Reply-To header values differ from the raw values inspected by a human reviewer or downstream parser, enabling apparent sender or recipient spoofing, phishing, or authorization-check bypass. This issue is fixed in version 2.9.1.
AnalysisAI
Header-value interpretation conflict in the Ruby mail gem (mikel/mail) before 2.9.1 allows remote attackers to craft malformed RFC 2047 encoded-words that cause Mail::Utilities.q_value_decode and b_value_decode to produce decoded From, To, and Reply-To values that differ materially from the raw wire values seen by human reviewers or downstream parsers. Because the old implementation used String#match with an overly greedy charset capture (.+? …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that an attacker can deliver a crafted email (containing a malformed RFC 2047 encoded-word in the From, To, or Reply-To display name or local-part) to a system running an unpatched mail gem (< 2.9.1) that parses the message using Mail::Utilities.q_value_decode or b_value_decode. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) is consistent with the vulnerability: network-reachable, no authentication, no user interaction required by the processing application, low integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the mikel/mail gem to version 2.9.1 or later, which is confirmed to contain the fix (GitHub release https://github.com/mikel/mail/releases/tag/2.9.1, commit f9d59c2e447af42e2c3dec5a56b1bb25c7292859). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the s
The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to /system/ws/v11/ss/email)
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF seq
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Rated critical severity (CVSS 9.8), t
Nextcloud Mail is an email application for the nextcloud personal cloud product. Rated critical severity (CVSS 9.8), thi
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attacke
Nextcloud mail is an email app for the nextcloud home server platform. Rated medium severity (CVSS 4.3), this vulnerabil
Nextcloud Mail is a mail app for Nextcloud. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable
Nextcloud Mail is a mail app for the Nextcloud platform. Rated medium severity (CVSS 4.3), this vulnerability is remotel
In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a cr
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Rated high severity (CVSS 8.1), this
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack. Rated high severity (
Same weakness CWE-436 – Interpretation Conflict
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise High Availability Extension 15 SP7 | Affected |
| SUSE Linux Enterprise High Availability Extension 15 SP4 | Affected |
| SUSE Linux Enterprise High Availability Extension 15 SP5 | Affected |
| SUSE Linux Enterprise High Availability Extension 15 | Affected |
| SUSE Linux Enterprise High Availability Extension 15 SP1 | Affected |
| SUSE Linux Enterprise High Availability Extension 15 SP2 | Affected |
| SUSE Linux Enterprise High Availability Extension 15 SP3 | Affected |
| SUSE Linux Enterprise High Availability Extension 15 SP6 | Affected |
| openSUSE Leap 15.3 | Affected |
| openSUSE Leap 15.4 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today