Improper Neutralization of Trailing Special Elements in net-imap - CVE-2026-47241

Vulnerability identifier: #VU162944

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-47241

CWE-ID: CWE-162

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated attacker to cause denial of service through hanging IMAP commands and timeouts.

The vulnerability exists due to incomplete trailing-marker validation in net-imap raw arguments when an application passes user-controlled input to affected commands. A remote authenticated attacker can supply arguments ending in {0} or {0+} for a victim to process, causing the server to absorb the next command and leave requests blocked.

net-imap
Debian Linux
Anolis OS
openEuler
rubygem-net-telnet
rubygem-rss
rubygem-xmlrpc
rubygem-abrt
rubygem-abrt-doc
rubygem-io-console
rubygem-mysql2-doc
rubygem-mysql2
rubygem-typeprof
rubygem-power_assert
rubygem-did_you_mean
rubygem-bigdecimal
rubygem-rbs
rubygem-pg-doc
rubygem-pg
rubygem-racc
rubygem-irb
rubygem-json
rubygem-openssl
rubygem-bundler
ruby
ruby-debuginfo
ruby-debugsource
ruby-devel
ruby-help
ruby-irb
rubygems
rubygems-devel
rubygem-psych
ruby-bundled-gems
rubygem-rexml
rubygem-test-unit
ruby-doc
ruby-default-gems
ruby-libs
rubygem-minitest
rubygem-rdoc
rubygem-rake
ruby3.3 (Debian package)

Install security update from vendor's website.

net-imap - addressed in versions 0.4.25, 0.5.15, 0.6.4.1
rubygem-net-telnet - update to 0.1.1-141
rubygem-rss - addressed in versions 0.2.9-149, 0.2.9-158, 0.2.9-159
rubygem-xmlrpc - update to 0.3.0-141
rubygem-rss - update to 0.3.1-8
rubygem-abrt - update to 0.4.0-1
rubygem-abrt-doc - update to 0.4.0-1
rubygem-io-console - addressed in versions 0.4.6-141, 0.5.7-149, 0.6.0-158, 0.6.0-159
rubygem-mysql2-doc - update to 0.5.5-1
rubygem-mysql2 - update to 0.5.5-1
rubygem-io-console - update to 0.7.1-8
rubygem-typeprof - addressed in versions 0.15.2-149, 0.21.3-158, 0.21.3-159
rubygem-typeprof - update to 0.21.9-8
rubygem-power_assert - update to 1.1.1-141
rubygem-did_you_mean - addressed in versions 1.2.0-141, 1.5.0-149, 1.6.3-158, 1.6.3-159
rubygem-bigdecimal - addressed in versions 1.3.4-141, 3.0.0-149, 3.1.3-158, 3.1.3-159
rubygem-rbs - addressed in versions 1.4.0-149, 2.8.2-158, 2.8.2-159
rubygem-pg-doc - update to 1.5.4-1
rubygem-pg - update to 1.5.4-1
rubygem-racc - update to 1.7.3-8
rubygem-irb - update to 1.13.1-8
rubygem-power_assert - update to 2.0.3-8
rubygem-json - addressed in versions 2.1.0-141, 2.5.1-149, 2.6.3-158, 2.6.3-159
rubygem-openssl - addressed in versions 2.1.2-141, 2.2.1-149, 3.1.0-158, 3.1.0-159
rubygem-bundler - update to 2.2.32-149
ruby - addressed in versions 2.5.8-141, 3.0.3-149, 3.2.2-158, 3.2.2-159
ruby-debuginfo - addressed in versions 2.5.8-141, 3.0.3-149, 3.2.2-158, 3.2.2-159
ruby-debugsource - addressed in versions 2.5.8-141, 3.0.3-149, 3.2.2-158, 3.2.2-159
ruby-devel - addressed in versions 2.5.8-141, 3.0.3-149, 3.2.2-158, 3.2.2-159
ruby-help - addressed in versions 2.5.8-141, 3.0.3-149, 3.2.2-158, 3.2.2-159
ruby-irb - addressed in versions 2.5.8-141, 3.0.3-149, 3.2.2-158, 3.2.2-159
rubygem-bundler - update to 2.5.22-8
rubygem-json - update to 2.7.2-8
rubygems - addressed in versions 2.7.6-141, 3.2.32-149, 3.4.10-158, 3.4.10-159
rubygems-devel - addressed in versions 2.7.6-141, 3.2.32-149, 3.4.10-158, 3.4.10-159
rubygem-psych - addressed in versions 3.0.2-141, 3.3.2-149, 5.0.1-158, 5.0.1-159
rubygem-bigdecimal - update to 3.1.5-8
ruby-bundled-gems - addressed in versions 3.2.2-158, 3.2.2-159
rubygem-rexml - addressed in versions 3.2.5-149, 3.2.5-158, 3.2.5-159
rubygem-test-unit - addressed in versions 3.2.7-141, 3.3.7-149, 3.5.7-158, 3.5.7-159
ruby-bundled-gems - update to 3.3.12-8
ruby-doc - update to 3.3.12-8
ruby-default-gems - update to 3.3.12-8
ruby-libs - update to 3.3.12-8
ruby-devel - update to 3.3.12-8
ruby - update to 3.3.12-8
rubygem-rbs - update to 3.4.0-8
rubygem-rexml - update to 3.4.4-8
rubygems - update to 3.5.22-8
rubygems-devel - update to 3.5.22-8
rubygem-test-unit - update to 3.6.1-8
rubygem-psych - update to 5.1.2-8
rubygem-minitest - addressed in versions 5.10.3-141, 5.14.2-149, 5.16.3-158, 5.16.3-159
rubygem-minitest - update to 5.20.0-8
rubygem-rdoc - addressed in versions 6.0.1.1-141, 6.3.3-149, 6.5.0-158, 6.5.0-159
rubygem-rdoc - update to 6.6.3.1-8
rubygem-rake - addressed in versions 12.3.0-141, 13.0.3-149, 13.0.6-158, 13.0.6-159
rubygem-rake - update to 13.1.0-8
ruby3.3 (Debian package) - update to 3.3.13-0+deb13u1

• https://github.com/ruby/net-imap/security/advisories/GHSA-c4fp-cxrr-mj66

• Debian update for ruby3.3
• openEuler 20.03 LTS SP4 update for ruby
• openEuler 24.03 LTS SP4 update for ruby
• openEuler 22.03 LTS SP4 update for ruby
• openEuler 24.03 LTS SP1 update for ruby
• openEuler 24.03 LTS SP3 update for ruby
• Anolis OS update for ruby:3.3 module
• Multiple vulnerabilities in net-imap