CVE-2026-47240
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
The Net::IMAP library in Ruby has a vulnerability that allows arbitrary IMAP command injection if the server does not support non-synchronizing literals. Versions prior to 0.6.5 and 0.5.15 are susceptible to an attack that may lead to unauthorized command execution.
Risk Assessment
Organizations using vulnerable versions may be exposed to CRLF injection attacks, potentially leading to unauthorized access to or manipulation of data.
Recommendation
It is recommended to update the Net::IMAP library to version 0.6.5 or 0.5.15 to mitigate this vulnerability.
Other vulnerabilities in Net::IMAP
See all- CVE-2026-42257Critical
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands.
- CVE-2026-47242Medium
The Net::IMAP library in Ruby has a vulnerability that allows arbitrary IMAP command injection due to improper validation of arguments in the #id and #enable methods. This issue affects versions prior to 0.6.5 and 0.5.15.
- CVE-2026-47241Low
Net::IMAP in Ruby prior to versions 0.6.5 and 0.5.15 has a vulnerability that allows an attacker to inject additional commands. By exploiting improperly validated arguments, an attacker can force the first command to wait for another command to finish.
- CVE-2026-42258Medium
The Net::IMAP library in Ruby before versions 0.4.24, 0.5.14, and 0.6.4 is vulnerable to CRLF injection / IMAP command injection via symbol arguments passed to IMAP commands.
- CVE-2026-42256Medium
In Net::IMAP for Ruby (versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, 0.6.0 to before 0.6.4), when authenticating with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack by sending a large iteration count value.
- CVE-2026-42246High
In the Net::IMAP library for Ruby prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause the starttls method to return 'successfully' without actually starting TLS.
- CVE-2026-42245High
Net::IMAP in Ruby has quadratic time complexity when reading large responses containing many string literals. A hostile server can send crafted responses to exhaust the client's CPU, leading to a denial of service (DoS) attack.
Original NVD description (English source)
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing literals, it may still be possible to inject arbitrary IMAP commands inside non-synchronizing literals. A server without support for non-synchronizing literals may interpret the "+}\r\n" as the end of a malformed command line and respond with a tagged BAD. In that case, the contents of the literal will be interpreted as one or more new pipelined commands, allowing a CRLF command injection attack to succeed. This affects criteria for #search and #uid_search; search_keys for #sort, #thread, #uid_sort, and #uid_thread; and attr for #fetch and #uid_fetch. This vulnerability is fixed in 0.6.5 and 0.5.15.