Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1807 advisory.

    zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0,     3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The     zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but     fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing     data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been     fixed in versions 3.0.1, 3.1.2 and 3.2.3. (CVE-2026-27820)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading     large responses containing many string literals. A hostile server can send responses which are crafted to     exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24,     0.5.14, and 0.6.4. (CVE-2026-42245)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to     return successfully, without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24,     0.5.14, and 0.6.4. (CVE-2026-42246)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions     0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a     connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service     attack on the client process by sending a big iteration count value. This issue has been patched in     versions 0.4.24, 0.5.14, and 0.6.4. (CVE-2026-42256)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent     to the server without validation or escaping. If this string is derived from user-controlled input, it may     contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue     has been patched in versions 0.4.24, 0.5.14, and 0.6.4. (CVE-2026-42257)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP     Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions     0.4.24, 0.5.14, and 0.6.4. (CVE-2026-42258)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading     large responses containing many string literals. A hostile server can send responses which are crafted to     exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24,     0.5.14, and 0.6.4. (CVE-2026-42245)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of the net-imap Ruby library installed on the remote host is prior to 0.4.24, 0.5.x prior to 0.5.14, or 0.6.x prior to 0.6.4. It is, therefore, affected by multiple vulnerabilities.

- The Net::IMAP::ResponseReader component is affected by a quadratic time complexity flaw when parsing large server responses containing numerous string literals. A malicious IMAP server can exploit this issue via crafted responses to exhaust client CPU resources and cause a denial of service. (CVE-2026-42245)

- Several Net::IMAP commands fail to properly validate or escape raw string arguments. If these strings incorporate user-controlled data, an attacker can use injected CRLF sequences to execute arbitrary IMAP commands. (CVE-2026-42257)

- Symbol arguments passed to IMAP commands are susceptible to CRLF/IMAP command injection. This vulnerability allows for the injection of arbitrary IMAP commands via specially crafted Symbol arguments. (CVE-2026-42258)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
319837	Amazon Linux 2023 : ruby3.4, ruby3.4-bundled-gems, ruby3.4-default-gems (ALAS2023-2026-1807)	Nessus	Amazon Linux Local Security Checks	high
315718	Linux Distros Unpatched Vulnerability : CVE-2026-42245	Nessus	Misc.	low
313278	Ruby net-imap < 0.4.24 / 0.5.x < 0.5.14 / 0.6.x < 0.6.4 Multiple Vulnerabilities	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-42245

low

Tenable Plugins

high

low

medium