This advisory covers three vulnerabilities in Ruby's Net::IMAP library as used in Red Hat Enterprise Linux 10 and related CodeReady Linux Builder products. CVE-2026-42245 describes a denial of service caused by crafted IMAP responses. CVE-2026-42258 involves IMAP command injection via symbol arguments. CVE-2026-42246 concerns information disclosure through man-in-the-middle attacks that bypass TLS protections. Red Hat has released updated Ruby packages to address these issues. The advisory references Red Hat Bugzilla entries and provides updated package versions for multiple architectures. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat Product Security.

Successful exploitation of these vulnerabilities could allow an attacker to cause a denial of service in applications using Ruby's Net::IMAP, execute unauthorized IMAP commands via injection, or disclose sensitive information by bypassing TLS encryption. This could impact the confidentiality, integrity, and availability of systems relying on the affected Ruby IMAP functionality. The advisory does not report known exploits in the wild.

Red Hat has released updated Ruby packages for Red Hat Enterprise Linux 10 and related CodeReady Linux Builder products that fix these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory RHSA-2026:33565 and the referenced article https://access.redhat.com/articles/11258. Since this is an official Red Hat security advisory with available updates, applying the vendor-provided patches is the recommended mitigation. Patch status is confirmed by the vendor advisory.