Medium severity5.3GHSA Advisory· Published May 9, 2026· Updated Aug 5, 2026
CVE-2026-42258
CVE-2026-42258
Description
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
net-imapRubyGems | >= 0.6.0, < 0.6.4 | 0.6.4 |
net-imapRubyGems | >= 0.5.0, < 0.5.14 | 0.5.14 |
net-imapRubyGems | < 0.4.24 | 0.4.24 |
Affected products
112- osv-coords110 versionspkg:apk/chainguard/gitlab-rails-ce-18.1pkg:apk/chainguard/gitlab-rails-ce-18.10pkg:apk/chainguard/gitlab-rails-ce-18.11pkg:apk/chainguard/gitlab-rails-ce-18.6pkg:apk/chainguard/gitlab-rails-ce-18.7pkg:apk/chainguard/gitlab-rails-ce-18.8pkg:apk/chainguard/gitlab-rails-ce-18.9pkg:apk/chainguard/gitlab-rails-ce-fips-18.10pkg:apk/chainguard/gitlab-rails-ce-fips-18.11pkg:apk/chainguard/gitlab-rails-ce-fips-18.3pkg:apk/chainguard/gitlab-rails-ce-fips-18.6pkg:apk/chainguard/gitlab-rails-ce-fips-18.9pkg:apk/chainguard/jruby-10.1pkg:apk/chainguard/jruby-9.4pkg:apk/chainguard/kube-fluentd-operatorpkg:apk/chainguard/logstash-8.19pkg:apk/chainguard/logstash-8.19-iamguarded-compatpkg:apk/chainguard/logstash-8.19-with-output-opensearchpkg:apk/chainguard/logstash-9.0pkg:apk/chainguard/logstash-9.0-iamguarded-compatpkg:apk/chainguard/logstash-9.0-with-output-opensearchpkg:apk/chainguard/logstash-9.3pkg:apk/chainguard/logstash-9.3-iamguarded-compatpkg:apk/chainguard/logstash-9.3-with-output-opensearchpkg:apk/chainguard/logstash-fips-9.3pkg:apk/chainguard/logstash-fips-9.3-iamguarded-compatpkg:apk/chainguard/ruby3.2-kube-logging-operator-fluentd-outputspkg:apk/chainguard/ruby3.2-net-imappkg:apk/chainguard/ruby3.2-rails-7.2pkg:apk/chainguard/ruby3.2-rails-8.0pkg:apk/chainguard/ruby3.2-rails-8.1pkg:apk/chainguard/ruby3.3-net-imappkg:apk/chainguard/ruby3.3-rails-7.2pkg:apk/chainguard/ruby3.3-rails-8.0pkg:apk/chainguard/ruby3.3-rails-8.1pkg:apk/chainguard/ruby3.4-kube-logging-operator-fluentd-outputspkg:apk/chainguard/ruby3.4-net-imappkg:apk/chainguard/ruby3.4-rails-7.2pkg:apk/chainguard/ruby3.4-rails-8.0pkg:apk/chainguard/ruby3.4-rails-8.1pkg:apk/chainguard/ruby4.0-net-imappkg:apk/chainguard/ruby4.0-rails-7.2pkg:apk/chainguard/ruby4.0-rails-8.0pkg:apk/chainguard/ruby4.0-rails-8.1pkg:apk/chainguard/trufflerubypkg:apk/wolfi/jruby-10.1pkg:apk/wolfi/jruby-9.4pkg:apk/wolfi/kube-fluentd-operatorpkg:apk/wolfi/logstash-9.3pkg:apk/wolfi/logstash-9.3-iamguarded-compatpkg:apk/wolfi/logstash-9.3-with-output-opensearchpkg:apk/wolfi/ruby3.2-kube-logging-operator-fluentd-outputspkg:apk/wolfi/ruby3.2-net-imappkg:apk/wolfi/ruby3.2-rails-8.0pkg:apk/wolfi/ruby3.2-rails-8.1pkg:apk/wolfi/ruby3.3-net-imappkg:apk/wolfi/ruby3.3-rails-8.0pkg:apk/wolfi/ruby3.3-rails-8.1pkg:apk/wolfi/ruby3.4-kube-logging-operator-fluentd-outputspkg:apk/wolfi/ruby3.4-net-imappkg:apk/wolfi/ruby3.4-rails-8.0pkg:apk/wolfi/ruby3.4-rails-8.1pkg:apk/wolfi/ruby4.0-net-imappkg:apk/wolfi/ruby4.0-rails-8.1pkg:gem/net-imappkg:rpm/almalinux/rubypkg:rpm/almalinux/ruby-bundled-gemspkg:rpm/almalinux/ruby-default-gemspkg:rpm/almalinux/ruby-develpkg:rpm/almalinux/ruby-docpkg:rpm/almalinux/ruby-irbpkg:rpm/almalinux/ruby-libspkg:rpm/almalinux/ruby4.0pkg:rpm/almalinux/ruby4.0-develpkg:rpm/almalinux/ruby4.0-docpkg:rpm/almalinux/ruby4.0-rubygem-mysql2pkg:rpm/almalinux/ruby4.0-rubygem-pgpkg:rpm/almalinux/rubygem-abrtpkg:rpm/almalinux/rubygem-abrt-docpkg:rpm/almalinux/rubygem-bigdecimalpkg:rpm/almalinux/rubygem-bsonpkg:rpm/almalinux/rubygem-bson-docpkg:rpm/almalinux/rubygem-bundlerpkg:rpm/almalinux/rubygem-bundler-docpkg:rpm/almalinux/rubygem-did_you_meanpkg:rpm/almalinux/rubygem-io-consolepkg:rpm/almalinux/rubygem-irbpkg:rpm/almalinux/rubygem-jsonpkg:rpm/almalinux/rubygem-minitestpkg:rpm/almalinux/rubygem-mongopkg:rpm/almalinux/rubygem-mongo-docpkg:rpm/almalinux/rubygem-mysql2pkg:rpm/almalinux/rubygem-mysql2-docpkg:rpm/almalinux/rubygem-net-telnetpkg:rpm/almalinux/rubygem-opensslpkg:rpm/almalinux/rubygem-pgpkg:rpm/almalinux/rubygem-pg-docpkg:rpm/almalinux/rubygem-power_assertpkg:rpm/almalinux/rubygem-psychpkg:rpm/almalinux/rubygem-raccpkg:rpm/almalinux/rubygem-rakepkg:rpm/almalinux/rubygem-rbspkg:rpm/almalinux/rubygem-rdocpkg:rpm/almalinux/rubygem-rexmlpkg:rpm/almalinux/rubygem-rsspkg:rpm/almalinux/rubygem-test-unitpkg:rpm/almalinux/rubygem-typeprofpkg:rpm/almalinux/rubygem-xmlrpcpkg:rpm/almalinux/rubygemspkg:rpm/almalinux/rubygems-devel
< 18.1.6-r10+ 109 more
- (no CPE)range: < 18.1.6-r10
- (no CPE)range: < 18.10.5-r1
- (no CPE)range: < 18.11.3-r1
- (no CPE)range: < 18.6.6-r4
- (no CPE)range: < 18.7.6-r3
- (no CPE)range: < 18.8.9-r1
- (no CPE)range: < 18.9.7-r2
- (no CPE)range: < 18.10.4-r1
- (no CPE)range: < 18.11.3-r2
- (no CPE)range: < 18.3.6-r7
- (no CPE)range: < 18.6.6-r4
- (no CPE)range: < 18.9.6-r1
- (no CPE)range: < 10.1.1.0-r1
- (no CPE)range: < 9.4.15.0-r2
- (no CPE)range: < 1.18.2-r70
- (no CPE)range: < 8.19.14-r4
- (no CPE)range: < 8.19.14-r4
- (no CPE)range: < 8.19.14-r4
- (no CPE)range: < 9.0.8-r21
- (no CPE)range: < 9.0.8-r21
- (no CPE)range: < 9.0.8-r21
- (no CPE)range: < 9.3.4-r1
- (no CPE)range: < 9.3.4-r1
- (no CPE)range: < 9.3.4-r1
- (no CPE)range: < 9.3.4-r1
- (no CPE)range: < 9.3.4-r1
- (no CPE)range: < 6.5.0-r2
- (no CPE)range: < 0.6.4-r0
- (no CPE)range: < 7.2.3.1-r2
- (no CPE)range: < 8.0.5-r1
- (no CPE)range: < 8.1.3-r3
- (no CPE)range: < 0.6.4-r0
- (no CPE)range: < 7.2.3.1-r2
- (no CPE)range: < 8.0.5-r2
- (no CPE)range: < 8.1.3-r4
- (no CPE)range: < 6.5.0-r2
- (no CPE)range: < 0.6.3-r0
- (no CPE)range: < 7.2.3.1-r3
- (no CPE)range: < 8.0.5-r2
- (no CPE)range: < 8.1.3-r3
- (no CPE)range: < 0.6.4-r0
- (no CPE)range: < 7.2.3.1-r3
- (no CPE)range: < 8.0.5-r2
- (no CPE)range: < 8.1.3-r4
- (no CPE)range: < 34.0.1-r2
- (no CPE)range: < 10.1.1.0-r1
- (no CPE)range: < 9.4.15.0-r2
- (no CPE)range: < 1.18.2-r70
- (no CPE)range: < 9.3.4-r1
- (no CPE)range: < 9.3.4-r1
- (no CPE)range: < 9.3.4-r1
- (no CPE)range: < 6.5.0-r2
- (no CPE)range: < 0.6.4-r0
- (no CPE)range: < 8.0.5-r1
- (no CPE)range: < 8.1.3-r3
- (no CPE)range: < 0.6.4-r0
- (no CPE)range: < 8.0.5-r2
- (no CPE)range: < 8.1.3-r4
- (no CPE)range: < 6.5.0-r2
- (no CPE)range: < 0.6.3-r0
- (no CPE)range: < 8.0.5-r2
- (no CPE)range: < 8.1.3-r3
- (no CPE)range: < 0.6.4-r0
- (no CPE)range: < 8.1.3-r4
- (no CPE)range: >= 0.6.0, < 0.6.4
- (no CPE)range: < 3.0.7-167.el9_8
- (no CPE)range: < 3.3.10-7.module_el8.10.0+4210+b037b1ec
- (no CPE)range: < 3.0.7-167.el9_8
- (no CPE)range: < 3.0.7-167.el9_8
- (no CPE)range: < 3.0.7-167.el9_8
- (no CPE)range: < 2.5.9-115.module_el8.10.0+4212+150d00eb
- (no CPE)range: < 3.0.7-167.el9_8
- (no CPE)range: < 4.0.3-35.el10_2
- (no CPE)range: < 4.0.3-35.el10_2
- (no CPE)range: < 4.0.3-35.el10_2
- (no CPE)range: < 0.5.7-35.el10_2
- (no CPE)range: < 1.6.3-35.el10_2
- (no CPE)range: < 0.3.0-4.module_el8.5.0+2625+ec418553
- (no CPE)range: < 0.3.0-4.module_el8.10.0+3871+342e2c2f
- (no CPE)range: < 3.0.0-167.el9_8
- (no CPE)range: < 4.3.0-2.module_el8.5.0+2625+ec418553
- (no CPE)range: < 4.3.0-2.module_el8.5.0+2625+ec418553
- (no CPE)range: < 2.2.33-167.el9_8
- (no CPE)range: < 1.16.1-5.module_el8.10.0+3991+5e651d4e
- (no CPE)range: < 1.2.0-115.module_el8.10.0+4212+150d00eb
- (no CPE)range: < 0.5.7-167.el9_8
- (no CPE)range: < 1.3.5-167.el9_8
- (no CPE)range: < 2.5.1-167.el9_8
- (no CPE)range: < 5.14.2-167.el9_8
- (no CPE)range: < 2.5.1-2.module_el8.5.0+2625+ec418553
- (no CPE)range: < 2.5.1-2.module_el8.5.0+2625+ec418553
- (no CPE)range: < 0.4.10-4.module_el8.5.0+259+8cec6917
- (no CPE)range: < 0.4.10-4.module_el8.5.0+2625+ec418553
- (no CPE)range: < 0.1.1-115.module_el8.10.0+4212+150d00eb
- (no CPE)range: < 2.1.2-115.module_el8.10.0+4212+150d00eb
- (no CPE)range: < 1.0.0-3.module_el8.9.0+3635+c6f99506
- (no CPE)range: < 1.0.0-3.module_el8.9.0+3635+c6f99506
- (no CPE)range: < 1.2.1-167.el9_8
- (no CPE)range: < 3.3.2-167.el9_8
- (no CPE)range: < 1.7.3-7.module_el8.10.0+4210+b037b1ec
- (no CPE)range: < 13.0.3-167.el9_8
- (no CPE)range: < 1.4.0-167.el9_8
- (no CPE)range: < 6.3.4.1-167.el9_8
- (no CPE)range: < 3.2.5-167.el9_8
- (no CPE)range: < 0.2.9-167.el9_8
- (no CPE)range: < 3.3.7-167.el9_8
- (no CPE)range: < 0.15.2-167.el9_8
- (no CPE)range: < 0.3.0-115.module_el8.10.0+4212+150d00eb
- (no CPE)range: < 3.2.33-167.el9_8
- (no CPE)range: < 3.2.33-167.el9_8
Patches
Vulnerability mechanics
References
35- github.com/advisories/GHSA-75xq-5h9v-w6pxghsaADVISORY
- github.com/ruby/net-imap/security/advisories/GHSA-75xq-5h9v-w6pxnvdMitigationVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-42258ghsaADVISORY
- access.redhat.com/errata/RHSA-2026:33462nvdWEB
- access.redhat.com/errata/RHSA-2026:33512nvdWEB
- access.redhat.com/errata/RHSA-2026:33514nvdWEB
- access.redhat.com/errata/RHSA-2026:33515nvdWEB
- access.redhat.com/errata/RHSA-2026:33540nvdWEB
- access.redhat.com/errata/RHSA-2026:33565nvdWEB
- access.redhat.com/errata/RHSA-2026:33576nvdWEB
- access.redhat.com/errata/RHSA-2026:33577nvdWEB
- access.redhat.com/errata/RHSA-2026:33630nvdWEB
- access.redhat.com/errata/RHSA-2026:33721ghsaWEB
- access.redhat.com/errata/RHSA-2026:34076nvdWEB
- access.redhat.com/errata/RHSA-2026:35447ghsaWEB
- access.redhat.com/errata/RHSA-2026:35834nvdWEB
- access.redhat.com/errata/RHSA-2026:35866nvdWEB
- access.redhat.com/errata/RHSA-2026:35867nvdWEB
- access.redhat.com/errata/RHSA-2026:35895nvdWEB
- access.redhat.com/errata/RHSA-2026:36099nvdWEB
- access.redhat.com/errata/RHSA-2026:36978nvdWEB
- access.redhat.com/errata/RHSA-2026:37238nvdWEB
- access.redhat.com/errata/RHSA-2026:37397nvdWEB
- access.redhat.com/errata/RHSA-2026:38694nvdWEB
- access.redhat.com/errata/RHSA-2026:40380nvdWEB
- access.redhat.com/security/cve/CVE-2026-42258nvdWEB
- bugzilla.redhat.com/show_bug.cginvdWEB
- github.com/ruby/net-imap/commit/6bf02aef7e0b5931010c36e377f79a71636b306bghsaWEB
- github.com/ruby/net-imap/commit/9db3e9d60bfb8f3735ea95015bf8a700f4af9cbbghsaWEB
- github.com/ruby/net-imap/commit/aec06996eb87a7e1bbcef1f9f8926e8add2b8c71ghsaWEB
- github.com/ruby/net-imap/releases/tag/v0.4.24nvdRelease NotesWEB
- github.com/ruby/net-imap/releases/tag/v0.5.14nvdRelease NotesWEB
- github.com/ruby/net-imap/releases/tag/v0.6.4nvdRelease NotesWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/net-imap/CVE-2026-42258.ymlghsaWEB
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42258.jsonnvdWEB
News mentions
1- Patch Tuesday - May 2026Rapid7 Blog · May 13, 2026