CVE-2026-47242 (MEDIUM): detected in Lambda Docker Images.

## CVE Details

| **CVE ID** | **Severity** | **Affected Package** | **Installed Version** | **Fixed Version** | **Date Published** | **Date of Scan** |
|-----------------|--------------|----------------------|-----------------------|-------------------|--------------------|------------------|
| [CVE-2026-47242](https://avd.aquasec.com/nvd/cve-2026-47242) | `MEDIUM` | `net-imap` | `0.5.8` | `~> 0.5.15, >= 0.6.4.1` | `2026-06-22T21:16:24.807Z` | `2026-06-24T10:19:10.31724607Z` |

---

## Affected Docker Images

| **Image Name** | **SHA** |
|-----------------------------|---------------------------------------|
| `public.ecr.aws/lambda/ruby:latest` | `public.ecr.aws/lambda/ruby@sha256:a00f8f33a0db8c2723951075efd02a008a758e3b86ee69a7448f3673b1790b00` |
| `public.ecr.aws/lambda/ruby:4.0` | `public.ecr.aws/lambda/ruby@sha256:deb470c7a55238628917444f3c4e7ad012ddab25cb22b072a38e5f16f8e5628e` |
| `public.ecr.aws/lambda/ruby:3.4` | `public.ecr.aws/lambda/ruby@sha256:a00f8f33a0db8c2723951075efd02a008a758e3b86ee69a7448f3673b1790b00` |
| `public.ecr.aws/lambda/ruby:3.3` | `public.ecr.aws/lambda/ruby@sha256:b1c634bf4af56649719a79ad3bbafd9bbd94384d2b2170f44dc84ed59bea1368` |

---

## Description

> Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAP#id is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences. While Net::IMAP#enable does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The #to_s value is sent verbatim. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands. This vulnerability is fixed in 0.6.5 and 0.5.15.

---

### Remediation Steps
- Update the affected package `net-imap` from version `0.5.8` to `~> 0.5.15, >= 0.6.4.1`.

### About this issue
- This issue may not contain all the information about the CVE nor the images it affects.
- This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
- For more, visit [Lambda Watchdog](https://lambdawatchdog.com).
- This issue was created automatically by Lambda Watchdog.

Start by locating the build and dependency definitions for the listed Lambda Ruby images and checking where net-imap 0.5.8 is introduced. Update the dependency to a fixed version supported by the issue, rebuild the affected images, and verify that the vulnerability scan no longer reports CVE-2026-47242.

Written by the indexing model from the issue text.