Allocation of Resources Without Limits or Throttling in net-imap - CVE-2026-42256

Vulnerability identifier: #VU162940

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-42256

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows an unauthenticated remote attacker to freeze an entire Ruby client process for minutes.

The vulnerability exists due to insufficient limits on PBKDF2 iteration counts in net-imap when a client authenticates to a hostile IMAP server using SCRAM-SHA1 or SCRAM-SHA256. An unauthenticated remote attacker can send an excessive iteration count in the server's authentication response, triggering expensive computation that blocks all Ruby threads in the client process.

net-imap
Debian Linux
Anolis OS
rubygem-rss
rubygem-abrt-doc
rubygem-abrt
rubygem-mysql2
rubygem-mysql2-doc
rubygem-io-console
rubygem-typeprof
rubygem-pg-doc
rubygem-pg
rubygem-racc
rubygem-irb
rubygem-power_assert
rubygem-bundler
rubygem-json
rubygem-bigdecimal
ruby
ruby-default-gems
ruby-bundled-gems
ruby-doc
ruby-libs
ruby-devel
rubygem-rbs
rubygem-rexml
rubygems
rubygems-devel
rubygem-test-unit
rubygem-psych
rubygem-minitest
rubygem-rdoc
rubygem-rake
ruby3.3 (Debian package)

Install security update from vendor's website.

net-imap - addressed in versions 0.4.24, 0.5.14, 0.6.4
rubygem-rss - update to 0.3.1-8
rubygem-abrt-doc - update to 0.4.0-1
rubygem-abrt - update to 0.4.0-1
rubygem-mysql2 - update to 0.5.5-1
rubygem-mysql2-doc - update to 0.5.5-1
rubygem-io-console - update to 0.7.1-8
rubygem-typeprof - update to 0.21.9-8
rubygem-pg-doc - update to 1.5.4-1
rubygem-pg - update to 1.5.4-1
rubygem-racc - update to 1.7.3-8
rubygem-irb - update to 1.13.1-8
rubygem-power_assert - update to 2.0.3-8
rubygem-bundler - update to 2.5.22-8
rubygem-json - update to 2.7.2-8
rubygem-bigdecimal - update to 3.1.5-8
ruby - update to 3.3.12-8
ruby-default-gems - update to 3.3.12-8
ruby-bundled-gems - update to 3.3.12-8
ruby-doc - update to 3.3.12-8
ruby-libs - update to 3.3.12-8
ruby-devel - update to 3.3.12-8
rubygem-rbs - update to 3.4.0-8
rubygem-rexml - update to 3.4.4-8
rubygems - update to 3.5.22-8
rubygems-devel - update to 3.5.22-8
rubygem-test-unit - update to 3.6.1-8
rubygem-psych - update to 5.1.2-8
rubygem-minitest - update to 5.20.0-8
rubygem-rdoc - update to 6.6.3.1-8
rubygem-rake - update to 13.1.0-8
ruby3.3 (Debian package) - update to 3.3.13-0+deb13u1

• https://github.com/ruby/net-imap/security/advisories/GHSA-87pf-fpwv-p7m7

• Debian update for ruby3.3
• Anolis OS update for ruby:3.3 module
• Multiple vulnerabilities in net-imap