security update for ruby

The vulnerability CVE-2026-47242 affects the Net::IMAP library in ruby:3.3 on Red Hat Enterprise Linux 9.6 Extended Update Support. It allows arbitrary IMAP command injection caused by improper input validation in the Net::IMAP implementation. Red Hat has issued a security advisory and provided updated ruby:3.3 packages to fix this issue. The advisory is classified as important in severity by Red Hat Product Security.

The vulnerability allows an attacker to inject arbitrary IMAP commands via the Net::IMAP library, potentially leading to unauthorized actions within IMAP sessions. Red Hat rates the security impact as important, indicating a significant but not critical threat level. No known exploits in the wild have been reported.

Red Hat has released updated ruby:3.3 packages for Red Hat Enterprise Linux 9.6 Extended Update Support that address this vulnerability. Users should apply these official updates as detailed in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate the issue. No additional mitigation steps are indicated beyond applying the provided patches.