CVE-2026-47240 is a command injection vulnerability in the Net::IMAP Ruby library, which provides IMAP client functionality. The flaw arises when an IMAP server does not support non-synchronizing literals, causing the library to misinterpret data as new IMAP commands. This can allow a remote attacker to inject arbitrary commands, potentially leading to unauthorized actions on the IMAP server. The vulnerability affects Red Hat Hardened Images RPMs including ruby3.3 and associated rubygem packages. Red Hat has released updated RPMs (version 3.3.10-23.4.hum1) to fix this issue. The vulnerability is tracked under CWE-93 (Improper Neutralization of CRLF Sequences) and CWE-88. The Red Hat advisory recommends validating user inputs to prevent embedded non-synchronizing literals or prohibiting embedded literals entirely unless supported by the server.

The vulnerability allows remote attackers to inject arbitrary IMAP commands against IMAP servers that lack support for non-synchronizing literals. This could enable unauthorized actions on the IMAP server, impacting the integrity of the server's data and operations. The confidentiality impact is not indicated, but integrity is rated high and availability impact is low. The risk primarily affects deployments interacting with older or non-standard IMAP server configurations.

A security update is available from Red Hat that addresses this vulnerability. Users should apply the updated ruby3.3 and related RPM packages (version 3.3.10-23.4.hum1) provided by Red Hat Hardened Images. Additionally, user-controlled inputs should be explicitly validated to prevent embedded non-synchronizing literals unless the IMAP server supports them. As a simpler mitigation, all embedded literals can be unconditionally prohibited by ensuring string inputs do not contain CR or LF bytes. Refer to the Red Hat advisory for detailed update instructions.