CVE-2026-42245 is a denial-of-service vulnerability in the Ruby Net::IMAP library, specifically in the ResponseReader component. The vulnerability arises from a quadratic time complexity in processing large IMAP responses containing numerous string literals, which a hostile IMAP server can exploit to exhaust the client's CPU resources. This results in a denial of service condition on the client application using the affected Net::IMAP library. The flaw does not permit code execution, privilege escalation, or unauthorized data access. Red Hat has issued a security advisory (RHSA-2026:33721) and released updated ruby3.3 RPM packages (version 3.3.10-23.2.hum1) for affected architectures (aarch64, x86_64, noarch) to remediate this issue. The advisory rates the impact as Moderate due to the requirement of interaction with a hostile server and the limited impact scope. Mitigation guidance includes restricting IMAP connections to trusted servers only.

The vulnerability can cause denial of service by exhausting CPU resources on clients using the affected Net::IMAP library when interacting with a malicious IMAP server. There is no impact on confidentiality, integrity, or privilege escalation. The attack requires a hostile IMAP server and user interaction (connecting to such a server). The overall impact is limited to availability degradation of the client process.

Red Hat has released updated ruby3.3 RPM packages (version 3.3.10-23.2.hum1) that fix this vulnerability. Users should apply these updates to remediate the issue. Additionally, to reduce risk, applications using the Net::IMAP library should be configured to connect only to trusted IMAP servers and avoid untrusted or unverified IMAP services. This operational control helps prevent exposure to malicious IMAP responses exploiting this vulnerability.