# CVE-2026-42257: net-imap — Fixed in 0.6.4 💎 RubyGems Not in CISA KEV # CVE-2026-42257 — net-imap [Fix: ruby/net-imap@0ec4fd3](https://github.com/ruby/net-imap/commit/0ec4fd351263e8b9a4f683713427827b7b1ad974) CVE-2026-42257 is a CWE-77 vulnerability in net-imap. A fix is available for net-imap — see the affected versions and patch details below. net-imap: Command Injection via "raw" arguments to multiple commands Also known as[GHSA-hm49-wcqc-g2xg](/vulnerability/GHSA-hm49-wcqc-g2xg) Published May 9, 2026 Updated Oct 28, 2026 Affected 3 pkgs Patched 3 / 3 Exploits None indexed Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-42257. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.4%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs37th percentile — riskier than 37% of all scored CVEsHighest risk 0.00%0.34%0.68%1.02%0.0%0.4%Jun 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## Real-World Exposure 3 pkgs affected 💎`net-imap`💎`net-imap`💎`net-imap` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems. ## Description #### Summary Several `Net::IMAP` commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain `CRLF` sequences, which an attacker can use to inject arbitrary IMAP commands. #### Details `Net::IMAP`'s generic argument handling, used by most command arguments, interprets string arguments as an IMAP `astring`. Depending on the string contents and the connection's UTF-8 support, this encodes strings as either a `atom`, `quoted`, or `literal`. These are safe from command or argument injection. But the following commands transform specific String arguments to `Net::IMAP::RawData`, which bypasses normal argument validation and encoding and prints the string directly to the socket: - `#uid_search`, `#search`, `#uid_sort`, `#sort`, `#uid_thread`, `#thread` - when `criteria` is a String, it is sent raw - `#uid_fetch`, \`#fetch - when `attr` is a String, it is sent raw - when `attr` is an Array, each String in `attr` is sent raw - `#uid_store`, `#store` - when `attr` is a String, it is sent raw - `#setquota`: - `limit` is interpolated with `#to_s` and that string is sent raw Because these string arguments are sent without any neutralization, they serve as a direct vector for command splitting. Any user controlled data interpolated into these strings can be used to break out of the intended command context. Using "raw data" arguments for `#uid_store`, `#store`, and `#setquota` I both inappropriate and unnecessary. `Net::IMAP`'s generic argument handling is sufficient to safely validate and encode their arguments. Users of the library probably do not expect arguments to these commands to be sent raw and might not be wary of passing unvalidated input. The API for search criteria and fetch attributes is intentionally low-level and "close to the wire". It allows developers to use some IMAP extensions without requiring explicit support from the library and allows developers to use complex IMAP grammar without complex argument translation. Even so, basic validation is appropriate and could neutralize command injection. Although this was explicitly documented for search `criteria`, it was insufficiently documented for fetch `attr`. So developers may not have realized that the `attr` argument to `#fetch` and `#uid_fetch` is sent as "raw data". #### Impact If a developer passes an unvalidated user-controlled input for one of these method arguments, an attacker can append CRLF sequence followed by a new IMAP command (like DELETE mailbox). Although this does not _directly_ enable data exfiltration, it could be combined with other attack vectors or knowledge of the target system's attributes, e.g.: shared mail folders or the application's installed response handlers. The SEARCH, STORE, and FETCH commands, and their UID variants are some of the most commonly used features of the library. Applications that build search queries or fetch attributes dynamically based on user input (e.g., mail clients or archival tools) may be at significant risk. The SORT and THREAD commands and their UID variants also handle their search criteria argument similarly to SEARCH and are subject to the same risk. Expected use of `Net::IMAP#setquota` is much more limited: `SETQUOTA` is often only usable by users with special administrative privileges. Depending on the server, quota administration might be managed through server configuration rather than via the IMAP protocol `SETQUOTA` command. It is expected to be uncommonly used in system administration scripts or in interactive sessions, it should be completely controlled by trusted users, and should only use trusted inputs. Calling `#setquota` with untrusted user input is expected to be a very uncommon use case. Please note however this might be combined with other attacks, for example CSRF, which provide unauthorized access to trusted inputs, and may specifically target users or scripts with administrator privileges. #### Mitigation - Update to a patched version of `net-imap` which: - validates that `Net::IMAP::RawData` is composed of well-formed IMAP `text`, `literal`, and `literal8` values, with no unescaped `NULL`, `CR`, or `LF` bytes. - does not use `Net::IMAP::RawData` for `#store`, `#uid_store`, or `#setquota`. - Prefer to send search criteria as an array of key value pairs. Avoid sending it as an interpolated string. - If an immediate upgrade is not possible: - String inputs to search criteria and fetch attributes can be validated against command injection by checking for `\r` and `\n` characters. - Hard-coding the store `attr` argument is often appropriate. Alternatively, user controlled inputs can be restricted to a small enumerated list which is valid for the calling application. - Use `Kernel#Integer` to coerce and validate user controlled inputs to `#setquota` limit. ## Affected Packages 3 total 3 fixed Ecosystem Package Vulnerable range Fix 💎RubyGems `net-imap` ≥ 0.6.0&&< 0.6.4 0.6.4`bundle update net-imap --conservative` 💎RubyGems `net-imap` ≥ 0.5.0&&< 0.5.14 0.5.14`bundle update net-imap --conservative` 💎RubyGems `net-imap` all versions 0.4.24`bundle update net-imap --conservative` ## Affected Products 1 product · 3 configurations Application `net\`ruby-lang ≥ 0.6.0 && < 0.6.4 1 version \\ ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for net-imap, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update net-imap to 0.6.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-42257 is resolved across your whole dependency graph. 3. ### Workarounds Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does. ## Fixing This On Your OS If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project. Red HatModerate Net::IMAP is vulnerable to IMAP command injection in versions before 0.4.24, 0.5.14, and 0.6.4. Several client commands accept raw string arguments that are sent to the IMAP server without CRLF validation or escaping; if application code passes user-controlled data into those arguments, an attacker can inject… Product Fixed in Advisory Red Hat Enterprise Linux 10 `ruby4.0-0:4.0.6-36.el10_2` [RHSA-2026:50773](https://access.redhat.com/errata/RHSA-2026:50773) Red Hat Enterprise Linux 10 `ruby-0:3.3.12-14.el10_2` [RHSA-2026:50778](https://access.redhat.com/errata/RHSA-2026:50778) Red Hat Enterprise Linux 8 `ruby:3.3-8100020260727154509.489197e6` [RHSA-2026:50728](https://access.redhat.com/errata/RHSA-2026:50728) Red Hat Enterprise Linux 9 `ruby:4.0-9080020260727092509.9` [RHSA-2026:50827](https://access.redhat.com/errata/RHSA-2026:50827) Red Hat Enterprise Linux 9 `ruby:3.3-9080020260728061751.9` [RHSA-2026:50828](https://access.redhat.com/errata/RHSA-2026:50828) Red Hat Hardened Images `ruby4-0-main-4.0.5-35.hum1` [RHSA-2026:36978](https://access.redhat.com/errata/RHSA-2026:36978) Red Hat Hardened Images `ruby3-4-main-3.4.10-31.hum1` [RHSA-2026:38694](https://access.redhat.com/errata/RHSA-2026:38694) Red Hat Hardened Images `ruby3-3-main-3.3.10-23.4.hum1` [RHSA-2026:40380](https://access.redhat.com/errata/RHSA-2026:40380) ## Frequently Asked Questions \### Summary Several \`Net::IMAP\` commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain \`CRLF\` sequences, which an attacker can use to inject arbitrary IMAP commands. ### Details \`Net::IMAP\`'s generic argument handling, used by most command arguments, interprets string arguments as an IMAP \`astring\`. Depending on the string contents and the connection's UTF-8 support, this encodes strings as either a \`atom\`, \`quoted\`, or \`literal\`. These are safe from command or argument i O3 Security · Impact-Aware SCA ### Is CVE-2026-42257 in your dependencies? Find it across RubyGems, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)