CVE-2026-42245 is a denial-of-service vulnerability in the Ruby Net::IMAP library, specifically in the ResponseReader component. The flaw arises from a quadratic time complexity when processing large IMAP responses containing numerous string literals, which can be exploited by a hostile IMAP server to exhaust the client's CPU resources. This vulnerability affects Red Hat Hardened Images RPMs containing Ruby 3.3 packages. Red Hat has rated the flaw as Moderate in severity and has released updated RPM packages (ruby3.3-3.3.10-23.2.hum1 and related gems) to fix the issue. The vulnerability requires interaction with a malicious IMAP server and impacts availability only, without compromising confidentiality or integrity. Red Hat advises restricting connections to trusted IMAP servers as a mitigation.

The vulnerability can cause a denial-of-service condition by exhausting CPU resources on clients using the affected Net::IMAP library when interacting with a hostile IMAP server. It does not allow code execution, privilege escalation, or unauthorized data access. The impact is limited to availability degradation of the affected client process. There are no known exploits in the wild.

Red Hat has released updated RPM packages that fix this vulnerability. Users should apply the security update to ruby3.3 and related packages as provided by Red Hat Hardened Images RPMs. Additionally, to reduce risk, applications using the Net::IMAP library should be configured to connect only to trusted IMAP servers and avoid untrusted or unverified IMAP services. This operational control helps prevent exposure to malicious IMAP responses. Patch status is confirmed fixed in ruby3.3 version 3.3.10-23.2.hum1 and associated packages.