This advisory covers three security vulnerabilities in the Ruby 4.0 net-imap library used in Red Hat Enterprise Linux 10 and related products. The vulnerabilities include: CVE-2026-42245, a denial of service caused by crafted IMAP responses; CVE-2026-42258, an IMAP command injection via symbol arguments; and CVE-2026-42246, an information disclosure vulnerability through man-in-the-middle attacks bypassing TLS. Red Hat has issued a security update (RHSA-2026:33540) that addresses these issues by updating the ruby4.0 packages across multiple architectures (x86_64, s390x, ppc64le, aarch64) and product variants including Extended Update Support and Extended Life Cycle versions. The advisory directs users to apply the update to mitigate these vulnerabilities.

The vulnerabilities allow attackers to cause denial of service via crafted IMAP responses, execute IMAP command injection through symbol arguments, and disclose information by bypassing TLS protections in man-in-the-middle scenarios. These issues could impact the confidentiality, integrity, and availability of systems running the affected Ruby net-imap library versions on Red Hat Enterprise Linux 10. The severity is rated as important by Red Hat Product Security.

Red Hat has released an official security update (RHSA-2026:33540) that fixes these vulnerabilities in ruby4.0 packages for Red Hat Enterprise Linux 10 and related products. Users should apply the update as detailed in the Red Hat advisory and referenced article (https://access.redhat.com/articles/11258) to remediate these issues. No additional mitigation steps are indicated beyond applying the official patch.