CVE-2026-42257 is an IMAP command injection vulnerability in the Ruby Net::IMAP library. Several client commands accept raw string arguments without validating or escaping carriage return and line feed (CRLF) sequences. If these arguments are derived from user-controlled input, an attacker can inject arbitrary IMAP commands by embedding CRLF sequences. Red Hat's impact is focused on Ruby-based products bundling the vulnerable net-imap gem, including RHEL Ruby module streams, OpenShift Serverless Ruby runtimes, and 3scale AMP components. The vulnerability is tracked under CWE-93 (Improper Neutralization of CRLF Sequences). Red Hat has issued updated ruby4.0 RPMs to fix this issue.

The vulnerability allows an attacker to inject arbitrary IMAP commands if user-controlled input is passed to vulnerable Net::IMAP client commands without validation. This can lead to modification of application data and potentially disrupt IMAP client-server communication. Red Hat rates the severity as high. There are no known exploits in the wild. The impact is limited to affected Ruby-based products that use the vulnerable net-imap gem with externally influenced input.

Red Hat has released updated ruby4.0 RPM packages (version 4.0.5-35.hum1) that fix this vulnerability. Users of affected Red Hat Hardened Images should apply these updates as soon as possible. The vendor advisory provides detailed instructions for applying the update. No additional mitigations are specified. Patch status is confirmed as fixed in the updated RPMs.