CVE-2026-42256
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In Net::IMAP for Ruby (versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, 0.6.0 to before 0.6.4), when authenticating with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack by sending a large iteration count value.
Risk Assessment
A malicious IMAP server can cause high CPU load on the client, leading to denial of service.
Recommendation
Update Net::IMAP to version 0.4.24, 0.5.14, or 0.6.4 (depending on the branch used).
Other vulnerabilities in Net::IMAP
See all- CVE-2026-42257Critical
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands.
- CVE-2026-47242Medium
The Net::IMAP library in Ruby has a vulnerability that allows arbitrary IMAP command injection due to improper validation of arguments in the #id and #enable methods. This issue affects versions prior to 0.6.5 and 0.5.15.
- CVE-2026-47241Low
Net::IMAP in Ruby prior to versions 0.6.5 and 0.5.15 has a vulnerability that allows an attacker to inject additional commands. By exploiting improperly validated arguments, an attacker can force the first command to wait for another command to finish.
- CVE-2026-47240Medium
The Net::IMAP library in Ruby has a vulnerability that allows arbitrary IMAP command injection if the server does not support non-synchronizing literals. Versions prior to 0.6.5 and 0.5.15 are susceptible to an attack that may lead to unauthorized command execution.
- CVE-2026-42258Medium
The Net::IMAP library in Ruby before versions 0.4.24, 0.5.14, and 0.6.4 is vulnerable to CRLF injection / IMAP command injection via symbol arguments passed to IMAP commands.
- CVE-2026-42246High
In the Net::IMAP library for Ruby prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause the starttls method to return 'successfully' without actually starting TLS.
- CVE-2026-42245High
Net::IMAP in Ruby has quadratic time complexity when reading large responses containing many string literals. A hostile server can send crafted responses to exhaust the client's CPU, leading to a denial of service (DoS) attack.
Original NVD description (English source)
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.