This advisory covers three security vulnerabilities in Ruby's Net::IMAP library as used in Red Hat Enterprise Linux 10 and related products. CVE-2026-42245 is a denial of service vulnerability triggered by crafted IMAP responses. CVE-2026-42258 involves IMAP command injection via symbol arguments, potentially allowing unintended command execution. CVE-2026-42246 allows information disclosure by bypassing TLS protections through a man-in-the-middle attack. Red Hat has released updated Ruby packages addressing these vulnerabilities. The advisory references Red Hat's errata RHSA-2026:33565 and provides package updates for various architectures and product variants. No CVSS scores are provided in the advisory, but the issues are rated as important.

The vulnerabilities could allow an attacker to cause denial of service on the affected system, inject unauthorized IMAP commands, or disclose sensitive information by bypassing TLS encryption. These impacts could affect applications or services using Ruby's Net::IMAP library for email interactions. The severity is rated as important by Red Hat, indicating a significant security risk if unpatched.

Red Hat has released updated Ruby packages that fix these vulnerabilities. Users of Red Hat Enterprise Linux 10 and related products should apply the security update as described in Red Hat advisory RHSA-2026:33565. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.