The Ruby net-imap library, which implements IMAP client functionality, contains a vulnerability (CVE-2026-42256) in versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4. When authenticating using SCRAM-SHA1 or SCRAM-SHA256, a malicious IMAP server can send a large iteration count value causing the client to perform excessive computation, resulting in a computational denial-of-service (DoS). This arises from the use of blocking code in a single-threaded, non-blocking context (CWE-1322). The issue has been addressed in versions 0.4.24, 0.5.14, and 0.6.4.

An attacker controlling an IMAP server can cause a client using vulnerable net-imap versions to consume excessive CPU resources during authentication, leading to a denial-of-service condition. This can degrade or halt client operations but does not involve code execution or data compromise. No known active exploitation has been reported.

Upgrading net-imap to versions 0.4.24, 0.5.14, or 0.6.4 or later fully mitigates this vulnerability. Since these patched versions address the issue, users should apply these updates promptly. Patch status is confirmed by the version information in the advisory. No additional vendor advisory content is available to indicate alternative mitigations or that no action is required.