The value of the Content-ID must be in the form of RFC-822 addr-spec (user @domain).
Since addr-spec may contain characters that are not allowed in the URL, these characters are encoded in hexadecimal if used in the cid URL.
In RFC2392:
URL- "cid" Content-ID header [MIME]
"cid:", % encoded US-ASCII, - , "& ;" " > ".
: http://www.faqs.org/rfcs/rfc2392.html