CVE-2026-42246: ruby net-imap Missing Report of Error Condition

Vulnerability summary

CVE-2026-42246 is a high (CVSS 7.6) Missing Report of Error Condition vulnerability in ruby net-imap. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.7% of scored vulnerabilities.

Timeline

1. 09-05-2026
   PublishedVulnerability first disclosed.
2. 24-08-2026
   Last modifiedVulnerability information updated.

Description

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.

• CWE-392Missing Report of Error ConditionThe product encounters an error but does not provide a status code or return value to indicate that an error has occurred.
• CWE-393Return of Wrong Status CodeA function or operation returns an incorrect return value or status code that does not indicate the true result of execution, causing the product to modify its behavior based on the incorrect result.
• CWE-636Not Failing Securely ('Failing Open')When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
• CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
• CWE-841Improper Enforcement of Behavioral WorkflowThe product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.
• CWE-325Missing Cryptographic StepThe product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.