Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing literals, it may still be possible to inject arbitrary IMAP commands inside non-synchronizing literals. A server without support for non-synchronizing literals may interpret the "+}\r\n" as the end of a malformed command line and respond with a tagged BAD. In that case, the contents of the literal will be interpreted as one or more new pipelined commands, allowing a CRLF command injection attack to succeed. This affects criteria for #search and #uid_search; search_keys for #sort, #thread, #uid_sort, and #uid_thread; and attr for #fetch and #uid_fetch. This vulnerability is fixed in 0.6.5 and 0.5.15.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3090-1 advisory.

    This update for ruby3.4 fixes the following issues

    - CVE-2026-42258: Net:IMAP: Command Injection via Symbol Arguments (bsc#1268011).
    - CVE-2026-47240: Net:IMAP: Command Injection via non-synchronizing literal in 'raw' argument     (bsc#1268337).
    - CVE-2026-47241: Net:IMAP: Denial of Service via incomplete raw argument validation (bsc#1268338).
    - CVE-2026-47242: Net:IMAP: Command Injection via ID and ENABLE command arguments (bsc#1268339).
    - CVE-2025-61594: merging URIs using the + operator could expose sensitive user credentials (bsc#1270034).

    Changes for ruby3.4:

    - Update to 3.4.10:

      - bundling net-imap 0.5.15.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-32d5a3d450 advisory.

    Ruby 4.0.6 is released. This new ruby contains several security fixes in net-snmp.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7f499e0362 advisory.

    Ruby 4.0.6 is released.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5     and 0.5.15, several Net::IMAP commands accept a raw data argument that is sent verbatim after validation     to prevent command injection. However, if a server does not support non-synchronizing literals, it may     still be possible to inject arbitrary IMAP commands inside non-synchronizing literals. A server without     support for non-synchronizing literals may interpret the +}\r\n as the end of a malformed command line     and respond with a tagged BAD. In that case, the contents of the literal will be interpreted as one or     more new pipelined commands, allowing a CRLF command injection attack to succeed. This affects criteria     for #search and #uid_search; search_keys for #sort, #thread, #uid_sort, and #uid_thread; and attr for     #fetch and #uid_fetch. This vulnerability is fixed in 0.6.5 and 0.5.15. (CVE-2026-47240)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of the net-imap Ruby library installed on the remote host is prior to 0.5.15, or 0.6.x prior to 0.6.4.1.
It is, therefore, affected by multiple vulnerabilities.

  - Several Net::IMAP commands accept a raw data argument that is sent verbatim after validation to prevent command     injection. However, if a server does not support non-synchronizing literals, it may still be possible to inject     arbitrary IMAP commands inside non-synchronizing literals. (CVE-2026-47240)

  - Several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and     then sent verbatim. If this string is derived from user-controlled input, an attacker can force the next command     to be absorbed as a continuation of the first command, causing a denial of service. (CVE-2026-47241)

  - Two Net::IMAP commands, id and enable, do not validate their arguments. Arguments to either command could be     used by an attacker to inject arbitrary IMAP commands. (CVE-2026-47242)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5
    and 0.5.15, several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation
    to prevent command injection. However, if a server does not support non-synchronizing literals, it may
    still be possible to inject arbitrary IMAP commands inside non-synchronizing literals. A server without
    support for non-synchronizing literals may interpret the "+}\r\n" as the end of a malformed command line
    and respond with a tagged BAD. In that case, the contents of the literal will be interpreted as one or
    more new pipelined commands, allowing a CRLF command injection attack to succeed. This affects criteria
    for #search and #uid_search; search_keys for #sort, #thread, #uid_sort, and #uid_thread; and attr for
    #fetch and #uid_fetch. This vulnerability is fixed in 0.6.5 and 0.5.15. (CVE-2026-47240)

ID	Name	Product	Family	Severity
327730	SUSE SLED15: libruby3_4-3_4 / ruby3.4 / ruby3.4-devel / ruby3.4-devel-extra / etc (SUSE-SU-2026:3090-1)	Nessus	SuSE Local Security Checks	medium
327721	Fedora 44 : ruby (2026-32d5a3d450)	Nessus	Fedora Local Security Checks	high
327016	Fedora 45 : ruby (2026-7f499e0362)	Nessus	Fedora Local Security Checks	high
323667	Linux Distros Unpatched Vulnerability : CVE-2026-47240	Nessus	Misc.	medium
321503	Ruby net-imap < 0.5.15 / 0.6.x < 0.6.4.1 Multiple Vulnerabilities	Nessus	Misc.	medium
442841	SCA: security update for net-imap (GHSA-8p34-64r3-mwg8)	Tenable Cloud Security	SCA Checks	medium
442841	SCA: security update for net-imap (GHSA-8p34-64r3-mwg8)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-47240

medium

Tenable Plugins

medium

high

high

medium

medium

medium

medium