CVE-2026-42258 Details
Description
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
A CRLF injection vulnerability has been identified in the Ruby Net::IMAP library, specifically in versions prior to 0.4.24, 0.5.14, and 0.6.4. This vulnerability allows for IMAP command injection through unvalidated Symbol arguments passed to IMAP commands. The issue arises because Symbol arguments, which represent IMAP 'system flags', are sent directly to the socket without proper validation. This lack of validation could be exploited to inject new commands by appending a CRLF sequence followed by a crafted Symbol argument.
Users are advised to upgrade to Net::IMAP versions 0.4.24, 0.5.14, or 0.6.4, all of which include the necessary patch. Additionally, ensure that user-controlled input is not allowed to directly influence the creation of Symbol arguments for IMAP commands.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | redhat-SADP |
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ruby-lang net::imap | < 0.4.24 >= 0.5.0, < 0.5.14 >= 0.6.0, < 0.6.4 |
CPE
Remediation
| |
Change History
21 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 24, 2026 | CVE Modified | redhat-SADP |
| Aug 5, 2026 | CVE Modified | redhat-SADP |
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 22, 2026 | CVE Modified | redhat-SADP |
| Jul 20, 2026 | CVE Modified | redhat-SADP |
| Jul 16, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 13, 2026 | CVE Modified | redhat-SADP |
| Jul 10, 2026 | CVE Modified | redhat-SADP |
| Jul 7, 2026 | CVE Modified | redhat-SADP |
| Jul 6, 2026 | CVE Modified | redhat-SADP |
| Jul 2, 2026 | CVE Modified | redhat-SADP |
| Jul 1, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 26, 2026 | Modified Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 9, 2026 | New CVE Received | [email protected] |