CVE-2026-42245 is a denial of service vulnerability in the Ruby Net::IMAP library, specifically in the ResponseReader component. The vulnerability arises from a quadratic time complexity flaw when processing large IMAP server responses containing numerous string literals. A malicious IMAP server can exploit this to exhaust the CPU resources of the client application using the affected Net::IMAP library, causing a denial of service. Red Hat has issued security updates for ruby3.4 packages in their Hardened Images RPMs to address this issue. The vulnerability requires interaction with a hostile IMAP server and does not permit code execution, privilege escalation, or unauthorized data access. Red Hat classifies the severity as moderate and recommends restricting connections to trusted IMAP servers as a mitigation.

The vulnerability allows a malicious IMAP server to cause excessive CPU consumption on client applications using the affected Net::IMAP library, resulting in a denial of service condition. There is no impact on confidentiality, integrity, or privilege escalation. The attack requires interaction with a hostile server and affects only the availability of the client process.

Red Hat has released updated ruby3.4 packages (version 3.4.10-31.hum1) that fix this vulnerability. Users should apply these updates to their Red Hat Hardened Images RPMs. Additionally, to reduce risk, applications using the Net::IMAP library should be configured to connect only to trusted IMAP servers and avoid untrusted or unverified IMAP services. This operational control helps prevent exposure to malicious IMAP responses exploiting this flaw.