This advisory covers two vulnerabilities in Ruby's Net::IMAP library as used in Red Hat Enterprise Linux 9 and associated products. CVE-2026-42258 is an IMAP command injection vulnerability via symbol arguments, and CVE-2026-42246 is an information disclosure vulnerability that enables man-in-the-middle attacks to bypass TLS protections. Red Hat has released an important security update to fix these issues. The advisory references Red Hat Bugzilla entries BZ-2468498 and BZ-2468499 for the respective CVEs. The update applies to Red Hat Enterprise Linux 9 and its variants, including Extended Update Support and Extended Life Cycle versions, as well as CodeReady Linux Builder for multiple architectures. No CVSS scores are provided in the advisory. The vendor recommends applying the update according to instructions in their knowledge base article.

The vulnerabilities allow an attacker to perform IMAP command injection via crafted symbol arguments, potentially leading to unauthorized command execution within the Net::IMAP context. Additionally, the information disclosure vulnerability enables a man-in-the-middle attacker to bypass TLS protections, potentially exposing sensitive information transmitted over IMAP connections. These issues could compromise confidentiality and integrity of communications using the affected Ruby Net::IMAP implementation on Red Hat Enterprise Linux 9 systems.

Red Hat has released an important security update that addresses these vulnerabilities. Users of Red Hat Enterprise Linux 9 and related products should apply the update as detailed in Red Hat's advisory and knowledge base article (https://access.redhat.com/articles/11258). Following the vendor's official update process will mitigate these vulnerabilities. No additional mitigation steps are indicated or required beyond applying the provided update.