Command injection in net-imap - CVE-2026-42258

Vulnerability identifier: #VU162941

CSH Severity: Medium

CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-42258

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows an unprivileged local attacker to inject IMAP commands and delete mailboxes when a user triggers a vulnerable application command.

The vulnerability exists due to missing validation of Symbol arguments in net-imap when applications pass user-controlled input as Symbols to IMAP commands. An unprivileged local attacker can include CRLF sequences in a Symbol to terminate the original command and append a mailbox deletion command.

net-imap
Debian Linux
Anolis OS
Ubuntu
openEuler
Fedora
libruby2.3 (Ubuntu package)
rubygem-net-telnet
rubygem-abrt
rubygem-abrt-doc
rubygem-xmlrpc
rubygem-rss
rubygem-io-console
rubygem-mysql2
rubygem-mysql2-doc
rubygem-typeprof
rubygem-pg
rubygem-pg-doc
rubygem-power_assert
rubygem-did_you_mean
rubygem-bigdecimal
rubygem-racc
rubygem-irb
rubygem-bundler
rubygem-bundler-doc
rubygem-json
rubygem-openssl
rubygem-mongo-doc
rubygem-mongo
ruby
ruby-debuginfo
ruby-debugsource
ruby-devel
ruby-help
ruby-irb
ruby-libs
ruby-doc
rubygems
rubygems-devel
rubygem-psych
rubygem-test-unit
rubygem-rexml
ruby-default-gems
ruby-bundled-gems
rubygem-rbs
rubygem-bson-doc
rubygem-bson
rubygem-minitest
rubygem-rdoc
rubygem-rake
ruby3.3 (Debian package)

Install security update from vendor's website.

net-imap - addressed in versions 0.4.24, 0.5.14, 0.6.4
libruby2.3 (Ubuntu package) - update to 2.3.1-2~ubuntu16.04.16+esm15
rubygem-net-telnet - update to 0.1.1-115.0.1
rubygem-net-telnet - update to 0.1.1-138
rubygem-abrt - addressed in versions 0.3.0-4, 0.4.0-1
rubygem-abrt-doc - addressed in versions 0.3.0-4, 0.4.0-1
rubygem-xmlrpc - update to 0.3.0-115.0.1
rubygem-xmlrpc - update to 0.3.0-138
rubygem-rss - addressed in versions 0.3.1-7, 0.3.1-8
rubygem-io-console - addressed in versions 0.4.6-115.0.1, 0.7.1-7, 0.7.1-8
rubygem-io-console - update to 0.4.6-138
rubygem-mysql2 - addressed in versions 0.4.10-4, 0.5.5-1
rubygem-mysql2-doc - addressed in versions 0.4.10-4, 0.5.5-1
rubygem-typeprof - addressed in versions 0.21.9-7, 0.21.9-8
rubygem-pg - addressed in versions 1.0.0-3.0.1, 1.5.4-1
rubygem-pg-doc - addressed in versions 1.0.0-3.0.1, 1.5.4-1
rubygem-power_assert - addressed in versions 1.1.1-115.0.1, 2.0.3-7, 2.0.3-8
rubygem-power_assert - update to 1.1.1-138
rubygem-did_you_mean - update to 1.2.0-115.0.1
rubygem-did_you_mean - update to 1.2.0-138
rubygem-bigdecimal - addressed in versions 1.3.4-115.0.1, 3.1.5-7, 3.1.5-8
rubygem-bigdecimal - update to 1.3.4-138
rubygem-racc - addressed in versions 1.7.3-7, 1.7.3-8
rubygem-irb - addressed in versions 1.13.1-7, 1.13.1-8
rubygem-bundler - addressed in versions 1.16.1-5, 2.5.22-7, 2.5.22-8
rubygem-bundler-doc - update to 1.16.1-5
rubygem-json - addressed in versions 2.1.0-115.0.1, 2.7.2-7, 2.7.2-8
rubygem-json - update to 2.1.0-138
rubygem-openssl - update to 2.1.2-115.0.1
rubygem-openssl - update to 2.1.2-138
rubygem-mongo-doc - update to 2.5.1-2
rubygem-mongo - update to 2.5.1-2
ruby - update to 2.5.8-138
ruby-debuginfo - update to 2.5.8-138
ruby-debugsource - update to 2.5.8-138
ruby-devel - update to 2.5.8-138
ruby-help - update to 2.5.8-138
ruby-irb - update to 2.5.8-138
ruby-irb - update to 2.5.9-115.0.1
ruby-libs - addressed in versions 2.5.9-115.0.1, 3.3.9-8, 3.3.10-7
ruby-devel - addressed in versions 2.5.9-115.0.1, 3.3.9-8, 3.3.10-7
ruby - addressed in versions 2.5.9-115.0.1, 3.3.9-8, 3.3.10-7
ruby-doc - addressed in versions 2.5.9-115.0.1, 3.3.9-8, 3.3.10-7
rubygems - update to 2.7.6-138
rubygems-devel - update to 2.7.6-138
rubygems-devel - addressed in versions 2.7.6.3-115.0.1, 3.5.22-7, 3.5.22-8
rubygems - addressed in versions 2.7.6.3-115.0.1, 3.5.22-7, 3.5.22-8
rubygem-psych - addressed in versions 3.0.2-115.0.1, 5.1.2-7, 5.1.2-8
rubygem-psych - update to 3.0.2-138
rubygem-test-unit - addressed in versions 3.2.7-115.0.1, 3.6.1-7, 3.6.1-8
rubygem-test-unit - update to 3.2.7-138
rubygem-rexml - addressed in versions 3.3.9-8, 3.4.4-7
ruby-default-gems - addressed in versions 3.3.9-8, 3.3.10-7
ruby-bundled-gems - addressed in versions 3.3.9-8, 3.3.10-7
rubygem-rbs - addressed in versions 3.4.0-7, 3.4.0-8
ruby - addressed in versions 3.4.10-31.fc43, 4.0.6-36.fc44, 4.0.6-36.fc45
rubygem-bson-doc - update to 4.3.0-2
rubygem-bson - update to 4.3.0-2
rubygem-minitest - addressed in versions 5.10.3-115.0.1, 5.20.0-7, 5.20.0-8
rubygem-minitest - update to 5.10.3-138
rubygem-rdoc - addressed in versions 6.0.1.1-115.0.1, 6.6.3.1-7, 6.6.3.1-8
rubygem-rdoc - update to 6.0.1.1-138
rubygem-rake - update to 12.3.0-138
rubygem-rake - addressed in versions 12.3.3-115.0.1, 13.1.0-7, 13.1.0-8
ruby3.3 (Debian package) - update to 3.3.13-0+deb13u1

• https://github.com/ruby/net-imap/security/advisories/GHSA-75xq-5h9v-w6px

• Debian update for ruby3.3
• Fedora 43 update for ruby
• Fedora 45 update for ruby
• Fedora 44 update for ruby
• openEuler update for ruby
• Anolis OS update for ruby
• Anolis OS update for ruby:3.3 module
• Anolis OS update for ruby:2.5 module
• Multiple vulnerabilities in net-imap
• Ubuntu update for ruby2.3