VYPR
← All advisories
Critical severity9.8GHSA Advisory· Published May 9, 2026· Updated May 18, 2026

CVE-2026-42257

CVE-2026-42257

Description

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
net-imapRubyGems
>= 0.6.0, < 0.6.40.6.4
net-imapRubyGems
>= 0.5.0, < 0.5.140.5.14
net-imapRubyGems
< 0.4.240.4.24

Affected products

63

Patches

Vulnerability mechanics

References

12

News mentions

1