CVE-2026-42257

CVE Details

Release Date:	2026-05-09
Impact:	Moderate	What is this?

Description

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

See more information about CVE-2026-42257 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	6.1
Vector String:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Version:	3.1
Attack Vector:	Local
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	Required
Scope:	Unchanged
Confidentiality Impact:	None
Integrity Impact:	High
Availability Impact:	Low

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (ruby)	ELSA-2026-50728	2026-08-10
Oracle Linux version 8 (rubygem-abrt)	ELSA-2026-50728	2026-08-10
Oracle Linux version 8 (rubygem-mysql2)	ELSA-2026-50728	2026-08-10
Oracle Linux version 8 (rubygem-pg)	ELSA-2026-50728	2026-08-10
Oracle Linux version 9 (ruby)	ELSA-2026-50827	2026-08-10
Oracle Linux version 9 (ruby)	ELSA-2026-50828	2026-08-07
Oracle Linux version 9 (rubygem-mysql2)	ELSA-2026-50827	2026-08-10
Oracle Linux version 9 (rubygem-mysql2)	ELSA-2026-50828	2026-08-07
Oracle Linux version 9 (rubygem-pg)	ELSA-2026-50827	2026-08-10
Oracle Linux version 9 (rubygem-pg)	ELSA-2026-50828	2026-08-07