CVE-2026-42245 is a denial of service vulnerability in the Ruby Net::IMAP library, specifically in the ResponseReader component. A malicious IMAP server can exploit a quadratic time complexity flaw by sending crafted large responses containing numerous string literals, causing the client application's CPU to be exhausted. This results in resource exhaustion and a denial of service on the client side. The vulnerability affects Red Hat Hardened Images RPMs containing ruby3.4 packages. Red Hat has issued security updates for multiple ruby3.4 RPMs to fix this issue. The vulnerability does not permit code execution, privilege escalation, or unauthorized access, limiting the impact to availability. Red Hat recommends connecting only to trusted IMAP servers to mitigate risk.

The vulnerability can cause denial of service by exhausting CPU resources of client applications using the affected Net::IMAP library when interacting with a hostile IMAP server. There is no impact on confidentiality, integrity, or privilege escalation. The attack requires a malicious IMAP server and user interaction to connect to it. The overall impact is limited to availability degradation of the affected client process.

Red Hat has released updated ruby3.4 RPM packages that address this vulnerability. Users should apply these security updates to their Red Hat Hardened Images RPMs. Additionally, to reduce risk, applications using the Net::IMAP library should be configured to connect only to trusted IMAP servers and avoid untrusted or unverified IMAP services. This operational control helps prevent exposure to malicious IMAP responses exploiting this flaw.