SB20261109182 - Multiple vulnerabilities in net-imap

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109182

SB20261109182 - Multiple vulnerabilities in net-imap

Published: November 9, 2026

Security Bulletin ID SB20261109182
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact

Breakdown by Severity

Medium 80% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Command injection (CVE-ID: CVE-2026-42257)

CWE-ID: CWE-77 - Command injection

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unprivileged local attacker to execute arbitrary IMAP commands through an application's authenticated connection to a mail server.

The vulnerability exists due to missing validation and escaping of raw arguments in net-imap commands when an application passes unvalidated, user-controlled input to affected methods. An unprivileged local attacker can insert CRLF sequences into these arguments to inject additional commands, such as deleting mailboxes, during normal application use.


2) Not Failing Securely ('Failing Open') (CVE-ID: CVE-2026-42246)

CWE-ID: CWE-636 - Not Failing Securely (\'Failing Open\')

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated network attacker to bypass TLS and expose sensitive information transmitted by an IMAP client.

The vulnerability exists due to net-imap accepting an early success response during a STARTTLS upgrade of a plaintext connection without ensuring TLS is established. An unauthenticated network attacker can intercept the connection and inject a predictably tagged response before the command finishes, leaving subsequent traffic unencrypted when the client does not explicitly verify TLS.


3) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-42245)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to exhaust a net-imap client's CPU and cause a denial of service.

The vulnerability exists due to quadratic processing in Net::IMAP::ResponseReader when repeated scans of a growing response buffer process many string literals. An unauthenticated remote attacker can send crafted responses from a hostile IMAP server to a connected client, causing excessive CPU consumption even below the default max_response_size limit.


4) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-42256)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to freeze an entire Ruby client process for minutes.

The vulnerability exists due to insufficient limits on PBKDF2 iteration counts in net-imap when a client authenticates to a hostile IMAP server using SCRAM-SHA1 or SCRAM-SHA256. An unauthenticated remote attacker can send an excessive iteration count in the server's authentication response, triggering expensive computation that blocks all Ruby threads in the client process.


5) Command injection (CVE-ID: CVE-2026-42258)

CWE-ID: CWE-77 - Command injection

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unprivileged local attacker to inject IMAP commands and delete mailboxes when a user triggers a vulnerable application command.

The vulnerability exists due to missing validation of Symbol arguments in net-imap when applications pass user-controlled input as Symbols to IMAP commands. An unprivileged local attacker can include CRLF sequences in a Symbol to terminate the original command and append a mailbox deletion command.


Remediation

Install update from vendor's website.

References