Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1667:01 advisory.

    * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
      * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input     (CVE-2026-42257)
      * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication     (CVE-2026-42256)
      * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
      * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation     (CVE-2026-47242)
      * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50728 advisory.

    * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

    * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input     (CVE-2026-42257)

    * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication     (CVE-2026-42256)

    * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

    * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

    * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

    Bug Fix(es) and Enhancement(s):

    * ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-8] (JIRA:Rocky Linux-170929)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50778 advisory.

    * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

    * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input     (CVE-2026-42257)

    * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication     (CVE-2026-42256)

    * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

    * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

    * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

    Bug Fix(es) and Enhancement(s):

    * ruby: Rebase to the latest Ruby 3.3 release [rhel-10.2.z] (JIRA:Rocky Linux-211300)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50773 advisory.

    * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

    * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input     (CVE-2026-42257)

    * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication     (CVE-2026-42256)

    * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

    * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

    * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

    Bug Fix(es) and Enhancement(s):

    * ruby4.0: Rebase to the latest Ruby 4.0 release [rhel-10.2.z] (JIRA:Rocky Linux-211310)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50828 advisory.

    * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

    * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input     (CVE-2026-42257)

    * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication     (CVE-2026-42256)

    * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

    * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

    * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

    Bug Fix(es) and Enhancement(s):

    * ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-9.8.z] (JIRA:Rocky Linux-171335)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50827 advisory.

    * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

    * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input     (CVE-2026-42257)

    * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication     (CVE-2026-42256)

    * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

    * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

    * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

    Bug Fix(es) and Enhancement(s):

    * ruby:4.0/ruby: Rebase to the latest Ruby 4.0 release [rhel-9.8.z] (JIRA:Rocky Linux-211301)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1647:01 advisory.

    * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
      * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input     (CVE-2026-42257)
      * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication     (CVE-2026-42256)
      * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
      * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation     (CVE-2026-47242)
      * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50778 advisory.

    [3.3.12-14]
    - Upgrade to Ruby 3.3.12.
      Resolves: RHEL-211300       Resolves: RHEL-193659

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50773 advisory.

    [4.0.6-36]
    - Upgrade to Ruby 4.0.6.
      Resolves: RHEL-211310       Resolves: RHEL-193660

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50728 advisory.

    ruby     [3.3.12-8]
    - Upgrade to Ruby 3.3.12.
      Resolves: RHEL-170929       Resolves: RHEL-193664

    rubygem-abrt     rubygem-mysql2     rubygem-pg

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50827 advisory.

    ruby     [4.0.6-34]
    - Upgrade to Ruby 4.0.6.
      Resolves: RHEL-211301       Resolves: RHEL-193663

    rubygem-mysql2     [0.5.7-1]
    - Upgrade to mysql2 0.5.7.
      Related: RHEL-142278

    [0.5.5-3]
    - Disable tests on the 32bit platforms ix86.
      Related: RHEL-80222

    [0.5.5-2]
    - Adapt tests to openssl 3.2       Resolves: RHEL-80222

    rubygem-pg     [1.6.3-1]
    - Upgrade to pg 1.6.3       Related: RHEL-142278

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50828 advisory.

    ruby     [3.3.12-8]
    - Upgrade to Ruby 3.3.12.
      Resolves: RHEL-171335       Resolves: RHEL-193665

    rubygem-mysql2     [0.5.5-3]
    - Disable tests on the 32bit platforms ix86.
      Related: RHEL-80222

    [0.5.5-2]
    - Adapt tests to openssl 3.2       Resolves: RHEL-80222

    [0.5.5-1]
    - Upgrade to mysql2 0.5.5.
      Related: RHEL-17089

    rubygem-pg     [-1.5.4-2]
    - Fix encoding issue in spec suite.
      Resolves: RHEL-159199

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1503:01 advisory.

    * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
      * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input     (CVE-2026-42257)
      * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication     (CVE-2026-42256)
      * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
      * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation     (CVE-2026-47242)
      * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org)     introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution     when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public     methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`,     `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a     Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code     execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch     the issue.(CVE-2026-41316)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP     Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions     0.4.24, 0.5.14, and 0.6.4.(CVE-2026-42258)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent     to the server without validation or escaping. If this string is derived from user-controlled input, it may     contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue     has been patched in versions 0.4.24, 0.5.14, and 0.6.4.(CVE-2026-42257)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to     return 'successfully', without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24,     0.5.14, and 0.6.4.(CVE-2026-42246)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading     large responses containing many string literals. A hostile server can send responses which are crafted to     exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24,     0.5.14, and 0.6.4.(CVE-2026-42245)

Tenable has extracted the preceding description block directly from the EulerOS ruby security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading     large responses containing many string literals. A hostile server can send responses which are crafted to     exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24,     0.5.14, and 0.6.4.(CVE-2026-42245)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to     return 'successfully', without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24,     0.5.14, and 0.6.4.(CVE-2026-42246)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP     Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions     0.4.24, 0.5.14, and 0.6.4.(CVE-2026-42258)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent     to the server without validation or escaping. If this string is derived from user-controlled input, it may     contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue     has been patched in versions 0.4.24, 0.5.14, and 0.6.4.(CVE-2026-42257)

    ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org)     introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution     when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public     methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`,     `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a     Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code     execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch     the issue.(CVE-2026-41316)

Tenable has extracted the preceding description block directly from the EulerOS ruby security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8431-1 advisory.

    It was discovered that Ruby's Net::IMAP library did not properly verify that Transport Layer Security     (TLS) encryption was started after issuing a STARTTLS command. A remote attacker could possibly use this     issue to perform a machine-in-the-middle attack and silently bypass TLS encryption. (CVE-2026-42246)

    It was also discovered that Ruby's Net::IMAP library did not validate string arguments passed to certain     commands. A remote attacker could possibly use this issue to inject arbitrary IMAP commands.
    (CVE-2026-42257)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1807 advisory.

    zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0,     3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The     zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but     fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing     data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been     fixed in versions 3.0.1, 3.1.2 and 3.2.3. (CVE-2026-27820)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading     large responses containing many string literals. A hostile server can send responses which are crafted to     exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24,     0.5.14, and 0.6.4. (CVE-2026-42245)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to     return successfully, without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24,     0.5.14, and 0.6.4. (CVE-2026-42246)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions     0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a     connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service     attack on the client process by sending a big iteration count value. This issue has been patched in     versions 0.4.24, 0.5.14, and 0.6.4. (CVE-2026-42256)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent     to the server without validation or escaping. If this string is derived from user-controlled input, it may     contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue     has been patched in versions 0.4.24, 0.5.14, and 0.6.4. (CVE-2026-42257)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP     Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions     0.4.24, 0.5.14, and 0.6.4. (CVE-2026-42258)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent     to the server without validation or escaping. If this string is derived from user-controlled input, it may     contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue     has been patched in versions 0.4.24, 0.5.14, and 0.6.4. (CVE-2026-42257)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of the net-imap Ruby library installed on the remote host is prior to 0.4.24, 0.5.x prior to 0.5.14, or 0.6.x prior to 0.6.4. It is, therefore, affected by multiple vulnerabilities.

- The Net::IMAP::ResponseReader component is affected by a quadratic time complexity flaw when parsing large server responses containing numerous string literals. A malicious IMAP server can exploit this issue via crafted responses to exhaust client CPU resources and cause a denial of service. (CVE-2026-42245)

- Several Net::IMAP commands fail to properly validate or escape raw string arguments. If these strings incorporate user-controlled data, an attacker can use injected CRLF sequences to execute arbitrary IMAP commands. (CVE-2026-42257)

- Symbol arguments passed to IMAP commands are susceptible to CRLF/IMAP command injection. This vulnerability allows for the injection of arbitrary IMAP commands via specially crafted Symbol arguments. (CVE-2026-42258)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to
    versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent
    to the server without validation or escaping. If this string is derived from user-controlled input, it may
    contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue
    has been patched in versions 0.4.24, 0.5.14, and 0.6.4. (CVE-2026-42257)

ID	Name	Product	Family	Type	Severity
341076	MiracleLinux 9 : ruby:4.0 (AXSA:2026-1667:01)	Nessus	Miracle Linux Local Security Checks	Local	medium
341008	RockyLinux 8 : ruby:3.3 (RLSA-2026:50728)	Nessus	Rocky Linux Local Security Checks	Local	medium
341007	RockyLinux 10 : ruby (RLSA-2026:50778)	Nessus	Rocky Linux Local Security Checks	Local	medium
341006	RockyLinux 10 : ruby4.0 (RLSA-2026:50773)	Nessus	Rocky Linux Local Security Checks	Local	medium
341005	RockyLinux 9 : ruby:3.3 (RLSA-2026:50828)	Nessus	Rocky Linux Local Security Checks	Local	medium
341004	RockyLinux 9 : ruby:4.0 (RLSA-2026:50827)	Nessus	Rocky Linux Local Security Checks	Local	medium
339405	MiracleLinux 9 : ruby:3.3 (AXSA:2026-1647:01)	Nessus	Miracle Linux Local Security Checks	Local	medium
335471	Oracle Linux 10 : ruby (ELSA-2026-50778)	Nessus	Oracle Linux Local Security Checks	Local	medium
335469	Oracle Linux 10 : ruby4.0 (ELSA-2026-50773)	Nessus	Oracle Linux Local Security Checks	Local	medium
334429	Oracle Linux 8 : ruby:3.3 (ELSA-2026-50728)	Nessus	Oracle Linux Local Security Checks	Local	medium
334161	Oracle Linux 9 : ruby:4.0 (ELSA-2026-50827)	Nessus	Oracle Linux Local Security Checks	Local	medium
334141	Oracle Linux 9 : ruby:3.3 (ELSA-2026-50828)	Nessus	Oracle Linux Local Security Checks	Local	medium
333609	MiracleLinux 8 : ruby:3.3 (AXSA:2026-1503:01)	Nessus	Miracle Linux Local Security Checks	Local	medium
333473	EulerOS 2.0 SP11 : ruby (EulerOS-SA-2026-3155)	Nessus	Huawei Local Security Checks	Local	high
333420	EulerOS 2.0 SP11 : ruby (EulerOS-SA-2026-3101)	Nessus	Huawei Local Security Checks	Local	high
332957	EulerOS 2.0 SP13 : ruby (EulerOS-SA-2026-2997)	Nessus	Huawei Local Security Checks	Local	high
332800	EulerOS 2.0 SP13 : ruby (EulerOS-SA-2026-3047)	Nessus	Huawei Local Security Checks	Local	high
321185	Ubuntu 16.04 LTS / 18.04 LTS : Ruby vulnerabilities (USN-8431-1)	Nessus	Ubuntu Local Security Checks	Local	high
319837	Amazon Linux 2023 : ruby3.4, ruby3.4-bundled-gems, ruby3.4-default-gems (ALAS2023-2026-1807)	Nessus	Amazon Linux Local Security Checks	Local	high
314319	Linux Distros Unpatched Vulnerability : CVE-2026-42257	Nessus	Misc.	Local	medium
313278	Ruby net-imap < 0.4.24 / 0.5.x < 0.5.14 / 0.6.x < 0.6.4 Multiple Vulnerabilities	Nessus	Misc.	Local	medium
441075	SCA: security update for net-imap (GHSA-hm49-wcqc-g2xg)	Tenable Cloud Security	SCA Checks	Local	medium
441075	SCA: security update for net-imap (GHSA-hm49-wcqc-g2xg)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-42257

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

high

high

medium

medium

medium

medium