CVE-2026-42258 — net-imap: Command Injection via unvalidated Symbol inputs

Description (CNA)

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Affected (CNA)

Vendor / product	Versions
ruby / net-imap	affected < 0.4.24; affected >= 0.5.0, < 0.5.14; affected >= 0.6.0, < 0.6.4

CWE

CWE-77, CWE-93

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Net::IMAP, a Ruby library that provides Internet Message Access Protocol (IMAP) client functionality. This vulnerability allows a remote attacker to inject arbitrary IMAP commands. This is achieved by passing specially crafted symbol arguments to IMAP commands. Successful exploitation could lead to unauthorized actions on the IMAP server or client, potentially resulting in information disclosure or other integrity impacts.