{"items":[{"id":"NVI-00015389","kind":"vulnerability","title":"Mail: Email address spoofing via malformed RFC 2047 encoded-words","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-mvxr-6m87-mv2q","CVE-2026-63435"],"plain_summary":"GitHub lists this reviewed advisory for mail. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2b3116693f7d9b008b6b5e0b38500ee5"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-02T22:02:33.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-6344432cd70f1d84ed2a7892851d394c"},{"kind":"CVSS","as_of":"2026-09-09T21:09:13.080Z","value":"5.3 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-2b3116693f7d9b008b6b5e0b38500ee5"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6344432cd70f1d84ed2a7892851d394c","url":"https://github.com/advisories/GHSA-mvxr-6m87-mv2q","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-mvxr-6m87-mv2q","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:21:29.477Z"},{"id":"sr-2b3116693f7d9b008b6b5e0b38500ee5","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63435","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-63435","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T15:07:15.902Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6344432cd70f1d84ed2a7892851d394c"],"technology":"mail","known_exclusions":[],"conditions_summary":"## Summary\n\nMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address.\n\n## Details\n\nBoth decoders used a single String#match against a pattern such as /\\=\\?(.+)?\\?[Qq]\\?(.*)\\?\\=/m. Two problems:\n\n1. Single match, dropped remainder. Only the first =?charset?Q?...?= (or ?B?) word was decoded. Any additional encoded-words or surrounding text were not handled consistently, so the decoded result could silently omit or alter parts of the input.\n2. Greedy charset capture. (.+)? is greedy and matches across ? delimiters, so a malformed word could span more of the string than a strict RFC 2047 parse would, changing the boundary between \"encoded\" and \"literal\" text.\n\n## Impact\n\nApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an ","public_affected_ranges":["< 2.9.1"]}],"null_published_at":"2026-11-08T19:53:44.043Z","source_updated_at":"2026-09-02T22:02:33.000Z","source_disclosed_at":"2026-09-02T22:02:32.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-02T02:21:29.477Z"},{"id":"NVI-00015389","kind":"vulnerability","title":"Mail: Email address spoofing via malformed RFC 2047 encoded-words","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-mvxr-6m87-mv2q","CVE-2026-63435"],"plain_summary":"GitHub lists this reviewed advisory for mail. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6344432cd70f1d84ed2a7892851d394c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-02T22:02:33.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-6344432cd70f1d84ed2a7892851d394c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6344432cd70f1d84ed2a7892851d394c","url":"https://github.com/advisories/GHSA-mvxr-6m87-mv2q","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-mvxr-6m87-mv2q","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:21:29.477Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6344432cd70f1d84ed2a7892851d394c"],"technology":"mail","known_exclusions":[],"conditions_summary":"## Summary\n\nMail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address.\n\n## Details\n\nBoth decoders used a single String#match against a pattern such as /\\=\\?(.+)?\\?[Qq]\\?(.*)\\?\\=/m. Two problems:\n\n1. Single match, dropped remainder. Only the first =?charset?Q?...?= (or ?B?) word was decoded. Any additional encoded-words or surrounding text were not handled consistently, so the decoded result could silently omit or alter parts of the input.\n2. Greedy charset capture. (.+)? is greedy and matches across ? delimiters, so a malformed word could span more of the string than a strict RFC 2047 parse would, changing the boundary between \"encoded\" and \"literal\" text.\n\n## Impact\n\nApplications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an ","public_affected_ranges":["< 2.9.1"]}],"null_published_at":"2026-11-03T10:03:31.362Z","source_updated_at":"2026-09-02T22:02:33.000Z","source_disclosed_at":"2026-09-02T22:02:32.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T02:21:29.477Z"}],"next_cursor":null,"snapshot_revision":"42594"}