CVE-2026-47240 Details
Description
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing literals, it may still be possible to inject arbitrary IMAP commands inside non-synchronizing literals. A server without support for non-synchronizing literals may interpret the "+}\r\n" as the end of a malformed command line and respond with a tagged BAD. In that case, the contents of the literal will be interpreted as one or more new pipelined commands, allowing a CRLF command injection attack to succeed. This affects criteria for #search and #uid_search; search_keys for #sort, #thread, #uid_sort, and #uid_thread; and attr for #fetch and #uid_fetch. This vulnerability is fixed in 0.6.5 and 0.5.15.
A command injection vulnerability has been identified in the Ruby Net::IMAP library, specifically in versions 0.6.0 prior to 0.6.5 and 0.5.14 prior to 0.5.15. The issue arises because several Net::IMAP commands allow a 'raw data' argument that is sent directly to the server after minimal validation. If the server does not support non-synchronizing literals, it may be possible to inject arbitrary IMAP commands by exploiting this feature. This vulnerability affects the 'criteria' argument for the '#search' and '#uid_search' methods, as well as the 'search_keys' argument for the '#sort', '#thread', '#uid_sort', and '#uid_thread' methods. Additionally, it impacts the 'attr' argument for the '#fetch' and '#uid_fetch' methods.
Users are advised to update to Net::IMAP version 0.6.5, 0.5.15, or 0.6.4.1. If upgrading is not possible, validate user inputs to prevent non-synchronizing literals from being sent to servers that do not support them, or check that the server advertises 'LITERAL+', 'LITERAL-', or 'IMAP4rev2' capabilities before using untrusted string inputs.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 22, 2026CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ruby/net-imap/security/advisories/GHSA-8p34-64r3-mwg8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ruby Net::IMAP | >= 0.6.0, <= 0.6.4 (semver) > 0, <= 0.5.14 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |