The Red Hat Security Advisory RHSA-2026:33514 reports two vulnerabilities in Ruby 2.5's Net::IMAP implementation. CVE-2026-42258 allows IMAP command injection via symbol arguments, potentially enabling attackers to execute unauthorized commands. CVE-2026-42246 allows information disclosure by bypassing TLS protections via a man-in-the-middle attack. These vulnerabilities affect the Ruby 2.5 module on Red Hat Enterprise Linux 8 across multiple architectures. Red Hat has issued patches to address these vulnerabilities.

The vulnerabilities could allow an attacker to inject IMAP commands, potentially leading to unauthorized actions, and to bypass TLS protections to disclose sensitive information during IMAP communications. These issues compromise the confidentiality and integrity of IMAP sessions using Ruby 2.5 on affected Red Hat Enterprise Linux systems.

Red Hat has released an updated Ruby 2.5 module package for Red Hat Enterprise Linux 8 that addresses these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate these issues. Since this is an official fix, applying the update is the recommended mitigation.