This advisory covers two vulnerabilities in the ruby:2.5 Net::IMAP library on Red Hat Enterprise Linux 8. CVE-2026-42258 is an IMAP command injection vulnerability via symbol arguments, and CVE-2026-42246 is an information disclosure vulnerability that enables man-in-the-middle attackers to bypass TLS protections. Red Hat has released an update for ruby:2.5.9-115.module+el8.10.0+24408+7ffaaa88.i686 and related packages to fix these issues. The advisory rates the update as Important with a high severity impact. No known exploits in the wild have been reported at this time.

Successful exploitation of CVE-2026-42258 could allow an attacker to inject IMAP commands, potentially leading to unauthorized actions within the IMAP protocol context. CVE-2026-42246 could allow an attacker to bypass TLS protections in a man-in-the-middle scenario, leading to information disclosure. Both vulnerabilities impact confidentiality and integrity of communications involving the Net::IMAP library in Ruby 2.5 on affected Red Hat Enterprise Linux 8 systems.

Red Hat has released an official security update for the ruby:2.5 module in Red Hat Enterprise Linux 8 that addresses these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2026:33514 and the referenced article https://access.redhat.com/articles/11258. Applying this update will remediate the vulnerabilities. No additional mitigation steps are indicated by the vendor.