SB20261109183 - Multiple vulnerabilities in net-imap
Published: November 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Command injection (CVE-ID: CVE-2026-47242)
CWE-ID: CWE-77 - Command injection
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a highly privileged local attacker to inject arbitrary IMAP commands and delete mailboxes through an affected application.
The vulnerability exists due to missing argument validation in net-imap's Net::IMAP#id and Net::IMAP#enable methods when untrusted input contains command-separating CRLF sequences. A highly privileged local attacker can supply CRLF sequences followed by IMAP commands when a victim runs an application that passes attacker-controlled input to these methods.
2) Command injection (CVE-ID: CVE-2026-47240)
CWE-ID: CWE-77 - Command injection
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an unprivileged local attacker to inject arbitrary IMAP commands into an application's session and delete mailboxes.
The vulnerability exists due to net-imap accepting non-synchronizing literals in raw arguments without verifying server support. An unprivileged local attacker can supply input that an application passes unvalidated to affected arguments, causing servers lacking literal support that continue after malformed commands to execute embedded commands.
3) Improper Neutralization of Trailing Special Elements (CVE-ID: CVE-2026-47241)
CWE-ID: CWE-162 - Improper Neutralization of Trailing Special Elements
CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated attacker to cause denial of service through hanging IMAP commands and timeouts.
The vulnerability exists due to incomplete trailing-marker validation in net-imap raw arguments when an application passes user-controlled input to affected commands. A remote authenticated attacker can supply arguments ending in {0} or {0+} for a victim to process, causing the server to absorb the next command and leave requests blocked.
Remediation
Install update from vendor's website.