CVE-2026-42257 Details
Description
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
A command injection vulnerability has been identified in the Ruby Net::IMAP library, specifically in versions prior to 0.4.24, 0.5.14, and 0.6.4. The vulnerability arises because several Net::IMAP commands allow raw string arguments to be sent to the server without proper validation or escaping. If these strings are based on user-controlled input, they can include CRLF sequences that inject arbitrary IMAP commands. This issue has been addressed in the mentioned patched versions.
Upgrade to Net::IMAP versions 0.4.24, 0.5.14, or 0.6.4, which include the necessary fixes. After upgrading, ensure that inputs to the IMAP commands are validated to prevent injection. For example, avoid sending raw data arguments unless they have been properly sanitized.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ruby/net-imap/releases/tag/v0.4.24 | [email protected] | Release Notes |
| https://github.com/ruby/net-imap/releases/tag/v0.5.14 | [email protected] | Release Notes |
| https://github.com/ruby/net-imap/releases/tag/v0.6.4 | [email protected] | Release Notes |
| https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ruby-lang net::imap | < 0.4.24 >= 0.5.0, < 0.5.14 >= 0.6.0, < 0.6.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 9, 2026 | New CVE Received | [email protected] |