CVE-2026-42245 is a denial-of-service vulnerability in the Ruby Net::IMAP library, specifically in the ResponseReader component. A malicious IMAP server can exploit a quadratic time complexity flaw when sending large responses containing numerous string literals, causing excessive CPU consumption on the client side. This results in a denial-of-service condition by exhausting the client process's CPU resources. The vulnerability affects Red Hat Hardened Images RPMs including ruby4.0 and associated rubygem4.0 packages. Red Hat has released updated RPMs (version 4.0.0-33.4.hum1 and related) to mitigate this issue. The vulnerability does not permit code execution, privilege escalation, or unauthorized data access, limiting the impact to availability. Red Hat recommends connecting only to trusted IMAP servers to reduce exposure risk.

The vulnerability can cause denial of service by exhausting CPU resources of applications using the affected Net::IMAP library when interacting with a hostile IMAP server. It does not enable code execution, privilege escalation, or unauthorized access to data. The impact is limited to availability degradation of the affected client process.

Red Hat has released updated RPM packages for ruby4.0 and related components that fix this vulnerability. Users should apply these updates as provided in the Red Hat advisory RHSA-2026:33551. Additionally, to reduce risk, applications using the Net::IMAP library should be configured to connect only to trusted IMAP servers and avoid untrusted or unverified IMAP services. This operational control helps prevent exploitation by malicious IMAP responses.