CVE-2026-42246

EUVD-2026-28924
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 23.64%
Affected Products (NVD)
VendorProductVersion
ruby-langnet\
𝑥
< 0.3.10
ruby-langnet\
0.4.0 ≤
𝑥
< 0.4.24
ruby-langnet\
0.5.0 ≤
𝑥
< 0.5.14
ruby-langnet\
0.6.0 ≤
𝑥
< 0.6.4
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Enterprise Linux 10
0:4.0.3-35.el10_2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 10
0:3.3.10-13.el10_2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support
0:3.3.10-11.el10_0.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support
0:2.0.0.648-39.el7_9.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
8100020260615131019.489197e6 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
8100020260615131010.489197e6 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
8040020260630124058.522a0ee4 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
8040020260630124058.522a0ee4 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
8060020260630123825.ad008a3a ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
8060020260630123825.ad008a3a ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service
8080020260625114827.63b34585 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions
8080020260625114827.63b34585 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
0:3.0.7-167.el9_8 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
9080020260615131001.9 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
9080020260619130154.9 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions
0:3.0.4-161.el9_2.3 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions
0:3.0.7-162.el9_4.3 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions
9040020260630065449.9 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support
0:3.0.7-165.el9_6.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support
9060020260630075016.9 ≤
𝑥
< *
ADP
Red HatRed Hat Hardened Images
4.0.0-33.4.hum1 ≤
𝑥
< *
ADP
Red HatRed Hat Hardened Images
3.4.10-31.hum1 ≤
𝑥
< *
ADP
Red HatRed Hat Hardened Images
3.4.8-31.2.hum1 ≤
𝑥
< *
ADP
Red HatRed Hat Hardened Images
3.3.10-23.2.hum1 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
ruby2.7
bullseye
vulnerable
bullseye (security)
vulnerable
ruby3.1
bookworm
vulnerable
bookworm (security)
vulnerable
ruby3.3
forky
vulnerable
sid
vulnerable
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby2.3
jammy
dne
noble
dne
questing
dne
resolute
dne
xenial
Fixed 2.3.1-2~ubuntu16.04.16+esm14
released
ruby2.5
bionic
Fixed 2.5.1-1ubuntu1.16+esm8
released
jammy
dne
noble
dne
questing
dne
resolute
dne
ruby2.7
focal
Fixed 2.7.0-5ubuntu1.18+esm5
released
jammy
dne
noble
dne
questing
dne
resolute
dne
ruby3.0
jammy
Fixed 3.0.2-7ubuntu2.13
released
noble
dne
questing
dne
resolute
dne
ruby3.2
jammy
dne
noble
Fixed 3.2.3-1ubuntu0.24.04.8
released
questing
dne
resolute
dne
ruby3.3
jammy
dne
noble
dne
questing
ignored
resolute
Fixed 3.3.8-2ubuntu3.1
released
jruby
bionic
needed
focal
needed
jammy
dne
noble
needed
questing
ignored
resolute
needed
trusty
needed
xenial
ignored
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
ruby
RHEL 9
0:3.0.7-167.el9_8
fixed
ruby-default-gems
RHEL 9
0:3.0.7-167.el9_8
fixed
ruby-devel
RHEL 9
0:3.0.7-167.el9_8
fixed
ruby-doc
RHEL 9
0:3.0.7-167.el9_8
fixed
ruby-libs
RHEL 9
0:3.0.7-167.el9_8
fixed
rubygem-bigdecimal
RHEL 9
0:3.0.0-167.el9_8
fixed
rubygem-bundler
RHEL 9
0:2.2.33-167.el9_8
fixed
rubygem-io-console
RHEL 9
0:0.5.7-167.el9_8
fixed
rubygem-irb
RHEL 9
0:1.3.5-167.el9_8
fixed
rubygem-json
RHEL 9
0:2.5.1-167.el9_8
fixed
rubygem-minitest
RHEL 9
0:5.14.2-167.el9_8
fixed
rubygem-power
RHEL 9
0:1.2.1-167.el9_8
fixed
rubygem-psych
RHEL 9
0:3.3.2-167.el9_8
fixed
rubygem-rake
RHEL 9
0:13.0.3-167.el9_8
fixed
rubygem-rbs
RHEL 9
0:1.4.0-167.el9_8
fixed
rubygem-rdoc
RHEL 9
0:6.3.4.1-167.el9_8
fixed
rubygem-rexml
RHEL 9
0:3.2.5-167.el9_8
fixed
rubygem-rss
RHEL 9
0:0.2.9-167.el9_8
fixed
rubygem-test-unit
RHEL 9
0:3.3.7-167.el9_8
fixed
rubygem-typeprof
RHEL 9
0:0.15.2-167.el9_8
fixed
rubygems
RHEL 9
0:3.2.33-167.el9_8
fixed
rubygems-devel
RHEL 9
0:3.2.33-167.el9_8
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
ruby
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.20
fixed
ruby-debuginfo
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.20
fixed
ruby-devel
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.20
fixed
ruby-doc
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.20
fixed
ruby-irb
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.20
fixed
ruby-libs
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.20
fixed
ruby-tcltk
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.20
fixed
ruby3.4
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-bundled-gems
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-bundled-gems-debuginfo
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-debuginfo
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-debugsource
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-default-gems
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-devel
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-doc
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-libs
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-libs-debuginfo
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-rubygem-bigdecimal
Amazon Linux 2023
0:3.1.8-27.amzn2023.0.6
fixed
ruby3.4-rubygem-bigdecimal-debuginfo
Amazon Linux 2023
0:3.1.8-27.amzn2023.0.6
fixed
ruby3.4-rubygem-bundler
Amazon Linux 2023
0:2.6.9-27.amzn2023.0.6
fixed
ruby3.4-rubygem-io-console
Amazon Linux 2023
0:0.8.1-27.amzn2023.0.6
fixed
ruby3.4-rubygem-io-console-debuginfo
Amazon Linux 2023
0:0.8.1-27.amzn2023.0.6
fixed
ruby3.4-rubygem-irb
Amazon Linux 2023
0:1.14.3-27.amzn2023.0.6
fixed
ruby3.4-rubygem-json
Amazon Linux 2023
0:2.9.1-27.amzn2023.0.6
fixed
ruby3.4-rubygem-json-debuginfo
Amazon Linux 2023
0:2.9.1-27.amzn2023.0.6
fixed
ruby3.4-rubygem-minitest
Amazon Linux 2023
0:5.25.4-27.amzn2023.0.6
fixed
ruby3.4-rubygem-power_assert
Amazon Linux 2023
0:2.0.5-27.amzn2023.0.6
fixed
ruby3.4-rubygem-psych
Amazon Linux 2023
0:5.2.2-27.amzn2023.0.6
fixed
ruby3.4-rubygem-psych-debuginfo
Amazon Linux 2023
0:5.2.2-27.amzn2023.0.6
fixed
ruby3.4-rubygem-racc
Amazon Linux 2023
0:1.8.1-27.amzn2023.0.6
fixed
ruby3.4-rubygem-racc-debuginfo
Amazon Linux 2023
0:1.8.1-27.amzn2023.0.6
fixed
ruby3.4-rubygem-rake
Amazon Linux 2023
0:13.2.1-27.amzn2023.0.6
fixed
ruby3.4-rubygem-rbs
Amazon Linux 2023
0:3.8.0-27.amzn2023.0.6
fixed
ruby3.4-rubygem-rbs-debuginfo
Amazon Linux 2023
0:3.8.0-27.amzn2023.0.6
fixed
ruby3.4-rubygem-rdoc
Amazon Linux 2023
0:6.14.0-27.amzn2023.0.6
fixed
ruby3.4-rubygem-rexml
Amazon Linux 2023
0:3.4.4-27.amzn2023.0.6
fixed
ruby3.4-rubygem-rss
Amazon Linux 2023
0:0.3.1-27.amzn2023.0.6
fixed
ruby3.4-rubygem-test-unit
Amazon Linux 2023
0:3.6.7-27.amzn2023.0.6
fixed
ruby3.4-rubygem-typeprof
Amazon Linux 2023
0:0.30.1-27.amzn2023.0.6
fixed
ruby3.4-rubygems
Amazon Linux 2023
0:3.6.9-27.amzn2023.0.6
fixed
ruby3.4-rubygems-devel
Amazon Linux 2023
0:3.6.9-27.amzn2023.0.6
fixed
ruby4.0
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-bundled-gems
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-bundled-gems-debuginfo
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-debuginfo
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-debugsource
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-default-gems
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-devel
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-doc
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-libs
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-libs-debuginfo
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-bigdecimal
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-bigdecimal-debuginfo
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-bundler
Amazon Linux 2023
0:4.0.3-32.amzn2023.0.2
fixed
ruby4.0-rubygem-io-console
Amazon Linux 2023
0:0.8.2-32.amzn2023.0.2
fixed
ruby4.0-rubygem-io-console-debuginfo
Amazon Linux 2023
0:0.8.2-32.amzn2023.0.2
fixed
ruby4.0-rubygem-irb
Amazon Linux 2023
0:1.16.0-32.amzn2023.0.2
fixed
ruby4.0-rubygem-json
Amazon Linux 2023
0:2.18.0-32.amzn2023.0.2
fixed
ruby4.0-rubygem-json-debuginfo
Amazon Linux 2023
0:2.18.0-32.amzn2023.0.2
fixed
ruby4.0-rubygem-minitest
Amazon Linux 2023
0:6.0.0-32.amzn2023.0.2
fixed
ruby4.0-rubygem-power_assert
Amazon Linux 2023
0:3.0.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-psych
Amazon Linux 2023
0:5.3.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-psych-debuginfo
Amazon Linux 2023
0:5.3.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-racc
Amazon Linux 2023
0:1.8.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-racc-debuginfo
Amazon Linux 2023
0:1.8.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-rake
Amazon Linux 2023
0:13.3.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-rbs
Amazon Linux 2023
0:3.10.0-32.amzn2023.0.2
fixed
ruby4.0-rubygem-rbs-debuginfo
Amazon Linux 2023
0:3.10.0-32.amzn2023.0.2
fixed
ruby4.0-rubygem-rdoc
Amazon Linux 2023
0:7.0.3-32.amzn2023.0.2
fixed
ruby4.0-rubygem-rexml
Amazon Linux 2023
0:3.4.4-32.amzn2023.0.2
fixed
ruby4.0-rubygem-rss
Amazon Linux 2023
0:0.3.2-32.amzn2023.0.2
fixed
ruby4.0-rubygem-test-unit
Amazon Linux 2023
0:3.7.5-32.amzn2023.0.2
fixed
ruby4.0-rubygem-typeprof
Amazon Linux 2023
0:0.31.1-32.amzn2023.0.2
fixed
ruby4.0-rubygems
Amazon Linux 2023
0:4.0.3-32.amzn2023.0.2
fixed
ruby4.0-rubygems-devel
Amazon Linux 2023
0:4.0.3-32.amzn2023.0.2
fixed
rubygem-bigdecimal
Amazon Linux 2
0:1.2.0-36.amzn2.0.20
fixed
rubygem-io-console
Amazon Linux 2
0:0.4.2-36.amzn2.0.20
fixed
rubygem-json
Amazon Linux 2
0:1.7.7-36.amzn2.0.20
fixed
rubygem-minitest
Amazon Linux 2
0:4.3.2-36.amzn2.0.20
fixed
rubygem-psych
Amazon Linux 2
0:2.0.0-36.amzn2.0.20
fixed
rubygem-rake
Amazon Linux 2
0:0.9.6-36.amzn2.0.20
fixed
rubygem-rdoc
Amazon Linux 2
0:4.0.0-36.amzn2.0.20
fixed
rubygems
Amazon Linux 2
0:2.0.14.1-36.amzn2.0.20
fixed
rubygems-devel
Amazon Linux 2
0:2.0.14.1-36.amzn2.0.20
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618
https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e
https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c
https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da
https://github.com/ruby/net-imap/releases/tag/v0.3.10
https://github.com/ruby/net-imap/releases/tag/v0.4.24
https://github.com/ruby/net-imap/releases/tag/v0.5.14
https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp
https://access.redhat.com/errata/RHSA-2026:33462
https://access.redhat.com/errata/RHSA-2026:33512
https://access.redhat.com/errata/RHSA-2026:33514
https://access.redhat.com/errata/RHSA-2026:33515
https://access.redhat.com/errata/RHSA-2026:33540
https://access.redhat.com/errata/RHSA-2026:33551
https://access.redhat.com/errata/RHSA-2026:33552
https://access.redhat.com/errata/RHSA-2026:33565
https://access.redhat.com/errata/RHSA-2026:33576
https://access.redhat.com/errata/RHSA-2026:33577
https://access.redhat.com/errata/RHSA-2026:33630
https://access.redhat.com/errata/RHSA-2026:33721
https://access.redhat.com/errata/RHSA-2026:34076
https://access.redhat.com/errata/RHSA-2026:35834
https://access.redhat.com/errata/RHSA-2026:35866
https://access.redhat.com/errata/RHSA-2026:35867
https://access.redhat.com/errata/RHSA-2026:35895
https://access.redhat.com/errata/RHSA-2026:36099
https://access.redhat.com/errata/RHSA-2026:37238
https://access.redhat.com/errata/RHSA-2026:37397
https://access.redhat.com/security/cve/CVE-2026-42246
https://bugzilla.redhat.com/show_bug.cgi?id=2468499
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42246.json