CVE-2026-47241 Details
Description
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and then sent verbatim. If this string is derived from user-controlled input, an attacker can force the next command to be absorbed as a continuation of the first command. This will cause the first command to eventually fail, but also prevents it from returning until another command is sent (from another thread). That other command will not return until the connection is closed. This vulnerability is fixed in 0.6.5 and 0.5.15.
A denial-of-service vulnerability has been identified in the Ruby Net::IMAP library, specifically in versions 0.6.0 prior to 0.6.5 and 0.5.14 prior to 0.5.15. The issue arises because several Net::IMAP commands allow raw string arguments that are only partially validated to prevent CRLF injection. This lack of proper validation can be exploited by an attacker who crafts a string from user-controlled input, causing the IMAP server to misinterpret command sequences. As a result, the first command hangs and fails to complete until another command is sent from a different thread, leading to potential timeouts and connection issues.
Users can update to Net::IMAP versions 0.6.4.1 or 0.5.15, both of which include the necessary validation improvements. If an upgrade is not possible, it's recommended to manually validate that user input does not end with a literal continuation marker and to use connection timeout strategies to mitigate the impact.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 22, 2026CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ruby/net-imap/security/advisories/GHSA-c4fp-cxrr-mj66 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-162 | Improper Neutralization of Trailing Special Elements | [email protected] |
| CWE-182 | Collapse of Data into Unsafe Value | [email protected] |
| CWE-186 | Overly Restrictive Regular Expression | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ruby Net::IMAP | >= 0.6.0, <= 0.6.4 (semver) <= 0.5.14 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |