CVE-2026-42258: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') in ruby net-imap
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
AI Analysis
Technical Summary
The Ruby net-imap library, which implements IMAP client functionality, contained a command injection vulnerability (CWE-77) due to improper neutralization of special elements in symbol arguments passed to IMAP commands. This allowed CRLF injection and IMAP command injection attacks. Versions prior to 0.4.24, 0.5.14, and 0.6.4 are affected. The vulnerability has been fixed in these versions. Red Hat has released security updates for their supported packages to remediate this issue.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker with local access to inject arbitrary IMAP commands via specially crafted symbol arguments, potentially leading to unauthorized command execution within the IMAP client context. The CVSS 4.0 base score is 5.8 (medium severity), reflecting the requirement for local access, high attack complexity, and partial impact on confidentiality and integrity.
Mitigation Recommendations
A fix is available and has been released in Ruby net-imap versions 0.4.24, 0.5.14, and 0.6.4. Users should upgrade to these or later versions to remediate the vulnerability. Red Hat has provided updated packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Applying these vendor-provided security updates is the recommended remediation. Patch status is confirmed by the vendor advisory.
CVE-2026-42258: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') in ruby net-imap
Description
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
CVSS v4.0
Score 5.8medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Ruby net-imap library, which implements IMAP client functionality, contained a command injection vulnerability (CWE-77) due to improper neutralization of special elements in symbol arguments passed to IMAP commands. This allowed CRLF injection and IMAP command injection attacks. Versions prior to 0.4.24, 0.5.14, and 0.6.4 are affected. The vulnerability has been fixed in these versions. Red Hat has released security updates for their supported packages to remediate this issue.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker with local access to inject arbitrary IMAP commands via specially crafted symbol arguments, potentially leading to unauthorized command execution within the IMAP client context. The CVSS 4.0 base score is 5.8 (medium severity), reflecting the requirement for local access, high attack complexity, and partial impact on confidentiality and integrity.
Mitigation Recommendations
A fix is available and has been released in Ruby net-imap versions 0.4.24, 0.5.14, and 0.6.4. Users should upgrade to these or later versions to remediate the vulnerability. Red Hat has provided updated packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Applying these vendor-provided security updates is the recommended remediation. Patch status is confirmed by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-26T11:53:27.704Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-42258","vendor":"Red Hat"}]
Threat ID: 69ff93c0cbff5d86106e459b
Added to database: 05/09/2026, 20:06:24 UTC
Last enriched: 07/22/2026, 21:55:37 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 114
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.