CVE-2026-63435: Parser Interpretation Conflict in Ruby Mail Gem RFC 2047 Decoders

The Ruby mail gem is a standard component utilized across the Ruby and Ruby on Rails ecosystems to generate, parse, and handle email transmission. In versions preceding 2.9.1, the utility modules responsible for parsing MIME-encoded headers exhibit parser discrepancies when handling RFC 2047 compliant 'encoded-words'.

RFC 2047 defines how non-ASCII text should be encoded inside email headers using specific metadata blocks like =?charset?encoding?encoded-text?=. The implementation of these parsers in the mail gem fails to handle multiple, adjoining, or malformed encoded-words sequentially, creating structural parsing conflicts.

Because email validation gateways (such as MTAs or SEGs) evaluate inbound emails differently than the backend application using the vulnerable mail parser, an attacker can exploit this discrepancy. The result is an interpretation conflict (CWE-436) that undermines trust boundaries established by validation protocols like SPF, DKIM, and DMARC.

The underlying technical flaw resides inside the decoding routines Mail::Utilities.b_value_decode and Mail::Utilities.q_value_decode in lib/mail/utilities.rb. Two specific implementation choices combine to produce the parsing vulnerability.

First, both methods call String#match with regex patterns like /\=\?(.+)?\?[Bb]\?(.*)\?\=/m and /\=\?(.+)?\?[Qq]\?(.*)\?\=/m. The use of String#match limits parsing to only the first matching substring, leaving subsequent encoded segments unparsed or mishandled. Additionally, the charset capturing group (.+)? is greedy. If a header contains multiple delimiters or nested parameters, the regex engine matches across multiple word boundaries to satisfy the wildcard greediness.

Second, the methods implement a broad exception-handling block. If the decoder encounters an unrecognized or malicious charset name (such as a string containing nested boundaries), charset_encoder.encode throws an Encoding::ConverterNotFoundError or ArgumentError. The rescue block responds by returning the raw, unparsed input string using str.dup.force_encoding(Encoding::UTF_8). This fatal rollback behavior exposes downstream parsers to unstripped MIME-token metadata.

A comparative analysis between the vulnerable implementation and the patch in version 2.9.1 reveals the shift from a singular matching architecture to a global, non-greedy parser.

Vulnerable Implementation

def Utilities.q_value_decode(str)
  # The regex utilizes greedy wildcard patterns and matches only once
  match = str.match(/\=\?(.+)?\?[Qq]\?(.*)\?\=/m)
  if match
    charset = match[1]
    string = match[2].gsub(/_/, '=20')
    string = string.sub(/\=$/, '')
    str = Encodings::QuotedPrintable.decode(string)
    str = charset_encoder.encode(str, charset)
  end
  transcode_to_scrubbed_utf8(str)
rescue Encoding::UndefinedConversionError, ArgumentError, Encoding::ConverterNotFoundError
  # Fallback logic exposes the entire raw string if the charset is invalid
  warn "WARNING: Encoding conversion failed #{$!}"
  str.dup.force_encoding(Encoding::UTF_8)
end

Patched Implementation

def Utilities.q_value_decode(str)
  # Transition to gsub ensures global matching over the entire string
  # Non-greedy exclusion characters [^?] isolate individual token elements
  q_decoded = str.gsub(/=\?([^?]+)\?[Qq]\?((?:[^?]\|\?(?!\=))*)\?=/m) do |_match|
    charset = $1
    string  = $2.gsub(/_/, '=20').sub(/\=$/, '')
 
    unquoted_printable = Encodings::QuotedPrintable.decode(string)
    decoded = begin
                # Exception handling is localized to the matched token block
                charset_encoder.encode(unquoted_printable, charset)
              rescue Encoding::UndefinedConversionError, ArgumentError, Encoding::ConverterNotFoundError
                warn "WARNING: Encoding conversion failed #{$!}"
                unquoted_printable.dup.force_encoding(Encoding::UTF_8)
              end
 
    decoded.force_encoding(Encoding::UTF_8) if decoded.encoding == Encoding::ASCII_8BIT
    decoded
  end
 
  transcode_to_scrubbed_utf8(q_decoded)
end

The implementation of String#gsub combined with the character exclusion expression [^?]+ prevents the parser from matching across field delimiters. Localizing the rescue block guarantees that an encoding error in a single malformed token does not abort processing for the entire header.

An attacker can exploit this vulnerability by constructing custom, malformed headers where the From, To, or Reply-To parameters contain nested RFC 2047 blocks.

Step-by-Step Scenario

1. The attacker drafts an email header containing a malformed charset definition: From: "John Doe" <=?UTF-8?Q?spoof?Q?agent?=@example.com>
2. The Mail Transfer Agent (MTA) or security gateway processes the incoming message. It decodes the sequence strictly according to standards. It processes agent@example.com as the sender, executing validation checks (SPF/DKIM/DMARC) against example.com.
3. The validated email is passed to the application backend, where the vulnerable mail gem parses the header string.
4. The greedy regex capture identifies the string UTF-8?Q?spoof as the charset name. Attempting to transcode this invalid charset triggers a ConverterNotFoundError within q_value_decode.
5. The rescue block triggers and returns the entire, raw unprocessed header value to the backend application.
6. The downstream application parses the raw string and processes the sender as spoof?Q?agent@example.com, causing the backend logic to handle a different entity than what was validated by the gateway security layer.

The impact of CVE-2026-63435 is categorized as a partial breach of integrity. Although the vulnerability does not lead to remote code execution (RCE) or information disclosure directly from the host system, it bypasses key infrastructural defenses.

By leveraging the interpretation discrepancy, attackers can successfully execute spear-phishing campaigns that bypass SPF and DKIM validation check outcomes. This allows malicious actors to impersonate trusted domain administrators or vendors, dropping spoofed messages directly into end-user mailboxes or target processing queues.

Additionally, applications that automatically route incoming support tickets, notifications, or processes based on the parsed From address can be fooled into executing actions on behalf of privileged users, escalating the impact beyond simple identity spoofing.

The primary resolution for this vulnerability is upgrading the underlying library dependencies to a non-vulnerable version.

Upgrading Dependencies

Update the library reference in your application's Gemfile to target version 2.9.1 or newer:

gem 'mail', '>= 2.9.1'

Execute Bundler to apply the update:

bundle update mail

Gateway Mitigations

In environments where upgrading the library is not immediately feasible, deploy ingress firewall rules or MTA filters on mail relays. These rules should scan for and reject email headers containing multiple embedded question marks inside the encoded-word parameters, or discard messages containing invalid, unparseable RFC 2047 character sets.