The Ruby net-imap library implements IMAP client functionality. Before versions 0.6.5 and 0.5.15, certain Net::IMAP commands accept a raw data argument that is sent verbatim after validation intended to prevent command injection. However, if the IMAP server does not support non-synchronizing literals, it may interpret the sequence "+}\r\n" as the end of a malformed command line, responding with a tagged BAD. This causes the literal contents to be interpreted as new pipelined commands, enabling a CRLF injection attack. The affected commands include #search, #uid_search, #sort, #thread, #uid_sort, #uid_thread, #fetch, and #uid_fetch. The vulnerability is addressed in net-imap versions 0.6.5 and 0.5.15.

An attacker can exploit this vulnerability to inject arbitrary IMAP commands when communicating with a server that does not support non-synchronizing literals. This could lead to unauthorized command execution within the IMAP session context. The CVSS 4.0 score is 5.8 (medium severity), reflecting local attack vector, low attack complexity, partial attack type, no privileges required, user interaction required, and high impact on integrity and low impact on availability and confidentiality.

This vulnerability is fixed in net-imap versions 0.6.5 and 0.5.15. Users should upgrade to at least these versions to remediate the issue. No official vendor advisory is provided, and no temporary mitigations are described. Patch status is not explicitly confirmed beyond the stated fixed versions, so users should verify upgrade applicability. There is no indication of known exploits in the wild.