CVE-2026-42258

EUVD-2026-28927
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
Command Injection
CRLF Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 52.62%
Affected Products (NVD)
VendorProductVersion
ruby-langnet\
𝑥
< 0.4.24
ruby-langnet\
0.5.0 ≤
𝑥
< 0.5.14
ruby-langnet\
0.6.0 ≤
𝑥
< 0.6.4
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Enterprise Linux 10
0:4.0.3-35.el10_2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 10
0:3.3.10-13.el10_2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support
0:3.3.10-11.el10_0.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support
0:2.0.0.648-39.el7_9.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
8100020260615131019.489197e6 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
8100020260615131010.489197e6 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
8040020260630124058.522a0ee4 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
8040020260630124058.522a0ee4 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
8060020260630123825.ad008a3a ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
8060020260630123825.ad008a3a ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service
8080020260625114827.63b34585 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions
8080020260625114827.63b34585 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
0:3.0.7-167.el9_8 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
9080020260615131001.9 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
9080020260619130154.9 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions
0:3.0.4-161.el9_2.3 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions
0:3.0.7-162.el9_4.3 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions
9040020260630065449.9 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support
0:3.0.7-165.el9_6.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support
9060020260630075016.9 ≤
𝑥
< *
ADP
Red HatRed Hat Hardened Images
4.0.5-35.hum1 ≤
𝑥
< *
ADP
Red HatRed Hat Hardened Images
3.4.10-31.hum1 ≤
𝑥
< *
ADP
Red HatRed Hat Hardened Images
3.3.10-23.4.hum1 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
ruby2.7
bullseye
vulnerable
bullseye (security)
vulnerable
ruby3.1
bookworm
vulnerable
bookworm (security)
vulnerable
ruby3.3
forky
vulnerable
sid
vulnerable
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby2.3
jammy
dne
noble
dne
questing
dne
resolute
dne
xenial
Fixed 2.3.1-2~ubuntu16.04.16+esm15
released
ruby3.3
jammy
dne
noble
dne
questing
ignored
resolute
needs-triage
jruby
bionic
needs-triage
focal
needs-triage
jammy
dne
noble
needs-triage
questing
ignored
resolute
needs-triage
trusty
needs-triage
xenial
ignored
ruby2.5
bionic
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
ruby2.7
focal
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
ruby3.0
jammy
needs-triage
noble
dne
questing
dne
resolute
dne
ruby3.2
jammy
dne
noble
needs-triage
questing
dne
resolute
dne
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libruby3_4-3_4
suse enterprise desktop 15 SP7
3.4.10-150700.3.4.1
fixed
suse enterprise sap 15 SP7
3.4.10-150700.3.4.1
fixed
suse enterprise server 15 SP7
3.4.10-150700.3.4.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
ruby
RHEL 9
0:3.0.7-167.el9_8
fixed
ruby-default-gems
RHEL 9
0:3.0.7-167.el9_8
fixed
ruby-devel
RHEL 9
0:3.0.7-167.el9_8
fixed
ruby-doc
RHEL 9
0:3.0.7-167.el9_8
fixed
ruby-libs
RHEL 9
0:3.0.7-167.el9_8
fixed
rubygem-bigdecimal
RHEL 9
0:3.0.0-167.el9_8
fixed
rubygem-bundler
RHEL 9
0:2.2.33-167.el9_8
fixed
rubygem-io-console
RHEL 9
0:0.5.7-167.el9_8
fixed
rubygem-irb
RHEL 9
0:1.3.5-167.el9_8
fixed
rubygem-json
RHEL 9
0:2.5.1-167.el9_8
fixed
rubygem-minitest
RHEL 9
0:5.14.2-167.el9_8
fixed
rubygem-power
RHEL 9
0:1.2.1-167.el9_8
fixed
rubygem-psych
RHEL 9
0:3.3.2-167.el9_8
fixed
rubygem-rake
RHEL 9
0:13.0.3-167.el9_8
fixed
rubygem-rbs
RHEL 9
0:1.4.0-167.el9_8
fixed
rubygem-rdoc
RHEL 9
0:6.3.4.1-167.el9_8
fixed
rubygem-rexml
RHEL 9
0:3.2.5-167.el9_8
fixed
rubygem-rss
RHEL 9
0:0.2.9-167.el9_8
fixed
rubygem-test-unit
RHEL 9
0:3.3.7-167.el9_8
fixed
rubygem-typeprof
RHEL 9
0:0.15.2-167.el9_8
fixed
rubygems
RHEL 9
0:3.2.33-167.el9_8
fixed
rubygems-devel
RHEL 9
0:3.2.33-167.el9_8
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
ruby3.4
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-bundled-gems
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-bundled-gems-debuginfo
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-debuginfo
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-debugsource
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-default-gems
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-devel
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-doc
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-libs
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-libs-debuginfo
Amazon Linux 2023
0:3.4.8-27.amzn2023.0.6
fixed
ruby3.4-rubygem-bigdecimal
Amazon Linux 2023
0:3.1.8-27.amzn2023.0.6
fixed
ruby3.4-rubygem-bigdecimal-debuginfo
Amazon Linux 2023
0:3.1.8-27.amzn2023.0.6
fixed
ruby3.4-rubygem-bundler
Amazon Linux 2023
0:2.6.9-27.amzn2023.0.6
fixed
ruby3.4-rubygem-io-console
Amazon Linux 2023
0:0.8.1-27.amzn2023.0.6
fixed
ruby3.4-rubygem-io-console-debuginfo
Amazon Linux 2023
0:0.8.1-27.amzn2023.0.6
fixed
ruby3.4-rubygem-irb
Amazon Linux 2023
0:1.14.3-27.amzn2023.0.6
fixed
ruby3.4-rubygem-json
Amazon Linux 2023
0:2.9.1-27.amzn2023.0.6
fixed
ruby3.4-rubygem-json-debuginfo
Amazon Linux 2023
0:2.9.1-27.amzn2023.0.6
fixed
ruby3.4-rubygem-minitest
Amazon Linux 2023
0:5.25.4-27.amzn2023.0.6
fixed
ruby3.4-rubygem-power_assert
Amazon Linux 2023
0:2.0.5-27.amzn2023.0.6
fixed
ruby3.4-rubygem-psych
Amazon Linux 2023
0:5.2.2-27.amzn2023.0.6
fixed
ruby3.4-rubygem-psych-debuginfo
Amazon Linux 2023
0:5.2.2-27.amzn2023.0.6
fixed
ruby3.4-rubygem-racc
Amazon Linux 2023
0:1.8.1-27.amzn2023.0.6
fixed
ruby3.4-rubygem-racc-debuginfo
Amazon Linux 2023
0:1.8.1-27.amzn2023.0.6
fixed
ruby3.4-rubygem-rake
Amazon Linux 2023
0:13.2.1-27.amzn2023.0.6
fixed
ruby3.4-rubygem-rbs
Amazon Linux 2023
0:3.8.0-27.amzn2023.0.6
fixed
ruby3.4-rubygem-rbs-debuginfo
Amazon Linux 2023
0:3.8.0-27.amzn2023.0.6
fixed
ruby3.4-rubygem-rdoc
Amazon Linux 2023
0:6.14.0-27.amzn2023.0.6
fixed
ruby3.4-rubygem-rexml
Amazon Linux 2023
0:3.4.4-27.amzn2023.0.6
fixed
ruby3.4-rubygem-rss
Amazon Linux 2023
0:0.3.1-27.amzn2023.0.6
fixed
ruby3.4-rubygem-test-unit
Amazon Linux 2023
0:3.6.7-27.amzn2023.0.6
fixed
ruby3.4-rubygem-typeprof
Amazon Linux 2023
0:0.30.1-27.amzn2023.0.6
fixed
ruby3.4-rubygems
Amazon Linux 2023
0:3.6.9-27.amzn2023.0.6
fixed
ruby3.4-rubygems-devel
Amazon Linux 2023
0:3.6.9-27.amzn2023.0.6
fixed
ruby4.0
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-bundled-gems
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-bundled-gems-debuginfo
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-debuginfo
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-debugsource
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-default-gems
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-devel
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-doc
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-libs
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-libs-debuginfo
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-bigdecimal
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-bigdecimal-debuginfo
Amazon Linux 2023
0:4.0.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-bundler
Amazon Linux 2023
0:4.0.3-32.amzn2023.0.2
fixed
ruby4.0-rubygem-io-console
Amazon Linux 2023
0:0.8.2-32.amzn2023.0.2
fixed
ruby4.0-rubygem-io-console-debuginfo
Amazon Linux 2023
0:0.8.2-32.amzn2023.0.2
fixed
ruby4.0-rubygem-irb
Amazon Linux 2023
0:1.16.0-32.amzn2023.0.2
fixed
ruby4.0-rubygem-json
Amazon Linux 2023
0:2.18.0-32.amzn2023.0.2
fixed
ruby4.0-rubygem-json-debuginfo
Amazon Linux 2023
0:2.18.0-32.amzn2023.0.2
fixed
ruby4.0-rubygem-minitest
Amazon Linux 2023
0:6.0.0-32.amzn2023.0.2
fixed
ruby4.0-rubygem-power_assert
Amazon Linux 2023
0:3.0.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-psych
Amazon Linux 2023
0:5.3.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-psych-debuginfo
Amazon Linux 2023
0:5.3.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-racc
Amazon Linux 2023
0:1.8.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-racc-debuginfo
Amazon Linux 2023
0:1.8.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-rake
Amazon Linux 2023
0:13.3.1-32.amzn2023.0.2
fixed
ruby4.0-rubygem-rbs
Amazon Linux 2023
0:3.10.0-32.amzn2023.0.2
fixed
ruby4.0-rubygem-rbs-debuginfo
Amazon Linux 2023
0:3.10.0-32.amzn2023.0.2
fixed
ruby4.0-rubygem-rdoc
Amazon Linux 2023
0:7.0.3-32.amzn2023.0.2
fixed
ruby4.0-rubygem-rexml
Amazon Linux 2023
0:3.4.4-32.amzn2023.0.2
fixed
ruby4.0-rubygem-rss
Amazon Linux 2023
0:0.3.2-32.amzn2023.0.2
fixed
ruby4.0-rubygem-test-unit
Amazon Linux 2023
0:3.7.5-32.amzn2023.0.2
fixed
ruby4.0-rubygem-typeprof
Amazon Linux 2023
0:0.31.1-32.amzn2023.0.2
fixed
ruby4.0-rubygems
Amazon Linux 2023
0:4.0.3-32.amzn2023.0.2
fixed
ruby4.0-rubygems-devel
Amazon Linux 2023
0:4.0.3-32.amzn2023.0.2
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/ruby/net-imap/releases/tag/v0.4.24
https://github.com/ruby/net-imap/releases/tag/v0.5.14
https://github.com/ruby/net-imap/releases/tag/v0.6.4
https://github.com/ruby/net-imap/security/advisories/GHSA-75xq-5h9v-w6px
https://access.redhat.com/errata/RHSA-2026:33462
https://access.redhat.com/errata/RHSA-2026:33512
https://access.redhat.com/errata/RHSA-2026:33514
https://access.redhat.com/errata/RHSA-2026:33515
https://access.redhat.com/errata/RHSA-2026:33540
https://access.redhat.com/errata/RHSA-2026:33565
https://access.redhat.com/errata/RHSA-2026:33576
https://access.redhat.com/errata/RHSA-2026:33577
https://access.redhat.com/errata/RHSA-2026:33630
https://access.redhat.com/errata/RHSA-2026:34076
https://access.redhat.com/errata/RHSA-2026:35834
https://access.redhat.com/errata/RHSA-2026:35866
https://access.redhat.com/errata/RHSA-2026:35867
https://access.redhat.com/errata/RHSA-2026:35895
https://access.redhat.com/errata/RHSA-2026:36099
https://access.redhat.com/errata/RHSA-2026:36978
https://access.redhat.com/errata/RHSA-2026:37238
https://access.redhat.com/errata/RHSA-2026:37397
https://access.redhat.com/errata/RHSA-2026:38694
https://access.redhat.com/errata/RHSA-2026:40380
https://access.redhat.com/security/cve/CVE-2026-42258
https://bugzilla.redhat.com/show_bug.cgi?id=2468498
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42258.json