CVE-2026-42245
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Net::IMAP in Ruby has quadratic time complexity when reading large responses containing many string literals. A hostile server can send crafted responses to exhaust the client's CPU, leading to a denial of service (DoS) attack.
Risk Assessment
An attacker can remotely exhaust the IMAP client's CPU resources, causing service unavailability for users.
Recommendation
Update the Net::IMAP library to version 0.4.24, 0.5.14, or 0.6.4, depending on the branch in use.
Other vulnerabilities in Net::IMAP
See all- CVE-2026-42257Critical
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands.
- CVE-2026-47242Medium
The Net::IMAP library in Ruby has a vulnerability that allows arbitrary IMAP command injection due to improper validation of arguments in the #id and #enable methods. This issue affects versions prior to 0.6.5 and 0.5.15.
- CVE-2026-47241Low
Net::IMAP in Ruby prior to versions 0.6.5 and 0.5.15 has a vulnerability that allows an attacker to inject additional commands. By exploiting improperly validated arguments, an attacker can force the first command to wait for another command to finish.
- CVE-2026-47240Medium
The Net::IMAP library in Ruby has a vulnerability that allows arbitrary IMAP command injection if the server does not support non-synchronizing literals. Versions prior to 0.6.5 and 0.5.15 are susceptible to an attack that may lead to unauthorized command execution.
- CVE-2026-42258Medium
The Net::IMAP library in Ruby before versions 0.4.24, 0.5.14, and 0.6.4 is vulnerable to CRLF injection / IMAP command injection via symbol arguments passed to IMAP commands.
- CVE-2026-42256Medium
In Net::IMAP for Ruby (versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, 0.6.0 to before 0.6.4), when authenticating with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack by sending a large iteration count value.
- CVE-2026-42246High
In the Net::IMAP library for Ruby prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause the starttls method to return 'successfully' without actually starting TLS.
Original NVD description (English source)
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.