CVE-2026-42256
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In Net::IMAP for Ruby (versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, 0.6.0 to before 0.6.4), when authenticating with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack by sending a large iteration count value.
Risk Assessment
A malicious IMAP server can cause high CPU load on the client, leading to denial of service.
Recommendation
Update Net::IMAP to version 0.4.24, 0.5.14, or 0.6.4 (depending on the branch used).
Original NVD description (English source)
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.