# CVE-2026-42258: net-imap — Fixed in 0.6.4 💎 RubyGems Not in CISA KEV # CVE-2026-42258 — net-imap [Fix: ruby/net-imap@aec0699](https://github.com/ruby/net-imap/commit/aec06996eb87a7e1bbcef1f9f8926e8add2b8c71) CVE-2026-42258 is a CWE-77 vulnerability in net-imap. A fix is available for net-imap — see the affected versions and patch details below. net-imap: Command Injection via unvalidated Symbol inputs Also known as[GHSA-75xq-5h9v-w6px](/vulnerability/GHSA-75xq-5h9v-w6px) Published May 9, 2026 Updated Oct 28, 2026 Affected 3 pkgs Patched 3 / 3 Exploits None indexed Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-42258. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.8%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs56th percentile — riskier than 56% of all scored CVEsHighest risk 0.00%0.58%1.17%1.75%0.1%0.8%Jun 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## Real-World Exposure 3 pkgs affected 💎`net-imap`💎`net-imap`💎`net-imap` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems. ## Description #### Summary Symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. #### Details Symbol arguments represent IMAP "system flags", which are formatted as "atoms" (with no quoting) with a `"\"` prefix. Vulnerable versions of Net::IMAP sends the symbol name directly to the socket, with no validation. Because the Symbol input is unvalidated, it could contain invalid `flag` characters, including `SP` and `CRLF`, which could be used to finish the current command and inject new commands. Although IMAP `flag` arguments are only valid input for a few IMAP commands, most Net::IMAP commands use generic argument handling, and will allow Symbol (`flag`) inputs. Note also that the list of valid symbol inputs should be restricted to an enumerated set of standard RFC defined flag types, which have each been given specific defined semantics. Any user-provided values outside of that list of standard "system flags" needs to use the IMAP `keyword` syntax, which are sent as atoms, i.e: string inputs. Under no circumstances should `#to_sym` ever be called on unvetted user-provided input: that will always be a bug in the calling code for the simple reason that `user_input_atom` is as `\user_input_atom`. For forward compatibility with future IMAP extentions, Net::IMAP, does not restrict flag inputs to an enumerated list. That is the responsibility of the calling application code, which knows which flag semantics are valid for its context. #### Impact If a developer passes user-controlled input as a Symbol to most Net::IMAP commands, an attacker can append CRLF sequence followed by a new IMAP command (like `DELETE mailbox`). #### Mitigation - Upgrade to a version of Net::IMAP that validates Symbols are valid as an IMAP `flag`. - User-provided input should never be able to control calling `#to_sym` on string arguments. For example, do not unsafely serialize and deserialize command arguments (e.g. with YAML or Marshal) in a way that could create unvetted Symbol arguments. - For the few IMAP commands which do allow `flag` arguments, it may be appropriate to hard-code Symbol arguments or restrict them to an enumerated list which is valid for the calling application. ## Affected Packages 3 total 3 fixed Ecosystem Package Vulnerable range Fix 💎RubyGems `net-imap` ≥ 0.6.0&&< 0.6.4 0.6.4`bundle update net-imap --conservative` 💎RubyGems `net-imap` ≥ 0.5.0&&< 0.5.14 0.5.14`bundle update net-imap --conservative` 💎RubyGems `net-imap` all versions 0.4.24`bundle update net-imap --conservative` ## Affected Products 1 product · 3 configurations Application `net\`ruby-lang ≥ 0.6.0 && < 0.6.4 1 version \\ ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for net-imap, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update net-imap to 0.6.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-42258 is resolved across your whole dependency graph. 3. ### Workarounds Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does. ## Fixing This On Your OS If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project. Red HatImportant This command injection flaw is limited to the injection of IMAP commands. Arbitrary code execution is not a risk of this flaw and so the impact is limited to email systems. Workaround published by Red Hat > Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Source: [Red Hat security advisory for CVE-2026-42258](https://access.redhat.com/security/cve/cve-2026-42258) (CC BY 4.0) Product Fixed in Advisory Red Hat Enterprise Linux 10 `ruby4.0-0:4.0.3-35.el10_2` [RHSA-2026:33540](https://access.redhat.com/errata/RHSA-2026:33540) Red Hat Enterprise Linux 10 `ruby-0:3.3.10-13.el10_2` [RHSA-2026:33565](https://access.redhat.com/errata/RHSA-2026:33565) Red Hat Enterprise Linux 10.0 Extended Update Support `ruby-0:3.3.10-11.el10_0.2` [RHSA-2026:35895](https://access.redhat.com/errata/RHSA-2026:35895) Red Hat Enterprise Linux 7 Extended Lifecycle Support `ruby-0:2.0.0.648-39.el7_9.1` [RHSA-2026:37397](https://access.redhat.com/errata/RHSA-2026:37397) Red Hat Enterprise Linux 8 `ruby:2.5-8100020260615131019.489197e6` [RHSA-2026:33514](https://access.redhat.com/errata/RHSA-2026:33514) Red Hat Enterprise Linux 8 `ruby:3.3-8100020260615131010.489197e6` [RHSA-2026:33515](https://access.redhat.com/errata/RHSA-2026:33515) Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support `ruby:2.5-8040020260630124058.522a0ee4` [RHSA-2026:35866](https://access.redhat.com/errata/RHSA-2026:35866) Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support `ruby:2.5-8060020260630123825.ad008a3a` [RHSA-2026:35867](https://access.redhat.com/errata/RHSA-2026:35867) ## Frequently Asked Questions \### Summary Symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. ### Details Symbol arguments represent IMAP "system flags", which are formatted as "atoms" (with no quoting) with a \`"\\"\` prefix. Vulnerable versions of Net::IMAP sends the symbol name directly to the socket, with no validation. Because the Symbol input is unvalidated, it could contain invalid \`flag\` characters, including \`SP\` and \`CRLF\`, which could be used to finish the current command and inject new commands. Although IMAP \`flag\` arguments O3 Security · Impact-Aware SCA ### Is CVE-2026-42258 in your dependencies? Find it across RubyGems, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)