CVE-2026-42245 is a denial of service vulnerability in the Ruby Net::IMAP library, specifically in the ResponseReader component. The issue arises from a quadratic time complexity when parsing large IMAP responses containing numerous string literals. A hostile IMAP server can exploit this flaw to exhaust the CPU resources of the client application using the affected library, causing a denial of service. The vulnerability impacts Red Hat Hardened Images RPMs that include ruby3.4 packages. Red Hat has issued security updates for multiple ruby3.4-related RPMs to fix this vulnerability. The flaw does not enable code execution, privilege escalation, or unauthorized data access, limiting the impact to availability. Red Hat recommends connecting only to trusted IMAP servers to mitigate risk.

The vulnerability allows a malicious IMAP server to cause excessive CPU consumption on clients using the affected Net::IMAP library, leading to denial of service. There is no impact on confidentiality, integrity, or privilege escalation. The primary impact is availability degradation of the affected client process. Exploitation requires interaction with a hostile IMAP server. No known exploits are reported in the wild at this time.

Red Hat has released updated ruby3.4 RPM packages that address this vulnerability. Users should apply these security updates to remediate the issue. Additionally, to reduce risk, applications using the Net::IMAP library should be configured to connect only to trusted IMAP servers and avoid untrusted or unverified IMAP services. This operational control helps prevent exposure to malicious IMAP response processing. No other mitigations are specified by the vendor.