Skip to content
CVE PROGRAM SOURCE RECORD5.8 Medium

CVE-2026-42258

net-imap: Command Injection via unvalidated Symbol inputs

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ruby net-imap

  • < 0.4.24affected
  • >= 0.5.0, < 0.5.14affected
  • >= 0.6.0, < 0.6.4affected

References