CVE-2026-42257 (Medium) detected in net-imap-0.5.12.gem

Vulnerable Library - net-imap-0.5.12.gem

Ruby client api for Internet Message Access Protocol

Library home page: https://rubygems.org/gems/net-imap-0.5.12.gem

Sample Path to Dependency File: /Gemfile.lock

Path to vulnerable library: /vendor/cache/net-imap-0.5.12.gem

Dependency Hierarchy:

• openid_connect-1.4.2.gem (Root Library)
  • validate_email-0.1.6.gem
    • mail-2.8.1.gem
      • ❌ net-imap-0.5.12.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Publish Date: 2026-05-09

URL: CVE-2026-42257

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg

Release Date: 2026-05-05

Fix Resolution: https://github.com/ruby/net-imap.git - v0.5.14,net-imap - 0.4.24,net-imap - 0.5.14,https://github.com/ruby/net-imap.git - v0.6.4,https://github.com/ruby/net-imap.git - v0.4.24,net-imap - 0.6.4