CVE-2026-42256: ruby net-imap
CVSS: 6.5v3.1MediumAnalyzed
AliasesSUSE-SU-2026:3792-1UBUNTU-CVE-2026-42256DEBIAN-CVE-2026-42256CGA-27fv-8r2g-jjrjCGA-29fc-jrx4-m9p8CGA-2cr6-7gfc-xj52CGA-2pqp-38hh-prp6CGA-3j58-32p3-x27jCGA-422x-4663-69xcCGA-4vgm-5w82-4wfxCGA-536p-33j8-5rf8CGA-7m8g-r5ph-qgfqCGA-fj79-w2wc-2f35CGA-fj8m-cw5r-cc9fCGA-gpjg-vf35-jm5wCGA-j55h-m446-w2xmCGA-j7w4-2hp5-2vmxCGA-j824-h652-gfj2CGA-jv9g-xw44-9hh9CGA-m3hg-5hx7-35v3CGA-m3hp-jccr-3jhpCGA-p2p7-v4jw-24fvCGA-p92q-cvw9-mhj9CGA-pf58-372r-f7vwCGA-q69x-rp8f-4pg6CGA-q6ph-mw54-vj4qCGA-qh92-g2gq-2q4jCGA-rwwx-r4v3-mhxhCGA-v2fm-c7xc-7qc4CGA-vq2r-qgrg-qc9pCGA-wp7r-grh4-j79fopenSUSE-SU-2026:21225-1CGA-268g-r3gh-23fpCGA-273j-442h-h7qjCGA-2g9p-qfq9-xc7qCGA-3fhv-42mm-mfhrCGA-42qc-c733-q6hrCGA-44w9-h8cj-rpq9CGA-462m-9hvc-h4w2CGA-4gmc-gm7m-834hCGA-4j2c-vhpg-5387CGA-4q6r-mjfc-p5xhCGA-4vc6-6mhj-q3vpCGA-5246-622r-mfwpCGA-55rc-5w25-fprvCGA-58qw-6x3p-p4jvCGA-5rqf-9mw2-mvv4CGA-5v6w-c9fg-8cr2CGA-5w73-ppwq-w829CGA-67rr-c53p-2hwmCGA-6h9p-6rp9-66mqCGA-6vj3-4p3x-64gmCGA-73mj-q35x-rq9cCGA-73rv-fhjw-mmgmCGA-76v2-wr69-f5c4CGA-7jm5-5v5f-8942CGA-82hf-92wq-mh57CGA-8f6x-6249-x43wCGA-8p28-pcxp-4qq6CGA-8x35-fp49-g58gCGA-938c-gffm-cc68CGA-9r9g-x7j4-gwhgCGA-9wgq-h636-v63jCGA-c34m-wh5w-88cvCGA-c7p6-gmq7-4f2wCGA-cp6p-6cc6-82vmCGA-fr38-9fjp-2xx4CGA-fvgj-wrjw-qhj7CGA-g9wp-v63v-9hjrCGA-ggqw-7r74-62rcCGA-h6rw-q5h2-x59fCGA-h8hr-m6pm-g3m6CGA-h9j8-r3mm-h36pCGA-hfj5-w4fv-5mwxCGA-hfmx-c8p5-6fr9CGA-j4qw-pw92-p8prCGA-j8hh-54mp-qh9xCGA-jc8m-h4vq-433wCGA-jccj-w83w-qhjgCGA-jcj8-wv6m-v3jrCGA-jmf8-wmjm-36v5CGA-jq3v-6hhc-vqvfCGA-jwwj-f84w-cmrgCGA-jx4r-9c5w-x6rxCGA-jxc9-7q99-9wqvCGA-m6pg-fmq7-67fwCGA-m7c8-hwh5-gmmhCGA-mr76-39vr-h3f4CGA-p48x-6666-f3pvCGA-p65m-x56r-cq74CGA-p9jj-7qvx-px55CGA-pjqf-3pmw-3845CGA-pm93-c53f-gppgCGA-pmpg-fv8r-775xGHSA-87pf-fpwv-p7m7CGA-px87-c492-whjqCGA-qcg7-mv27-4g8hCGA-qh9v-7mgj-jrvrCGA-qprx-297h-77r5CGA-qv3x-mrf6-2h3rCGA-qx3q-qj9q-mvfqCGA-rggw-xvgm-j3rpCGA-rh3r-7ggg-qmqvCGA-v6jp-h5gg-v498CGA-v8r9-84j2-6fhvCGA-v8wx-m5h9-rqpwCGA-v92h-2grv-qph3CGA-vh2x-jpc5-r674CGA-vh33-46hm-23q8CGA-vjxc-v9h5-j7q3CGA-vmqc-p898-3mqhCGA-vwjw-6429-v3vfCGA-w8xg-2g5m-3rjjCGA-w9hh-79r8-5488CGA-wjq9-pfrc-fr8rCGA-wv68-vh9c-5fhpCGA-wxvh-4c65-44rhCGA-xgfj-qxhp-99vcCGA-xq95-mfv8-qr5vCGA-xrwc-4q2f-7xmh
Published 09-05-2026Last modified 11-05-2026
Vulnerability summary
CVE-2026-42256 is a medium (CVSS 6.5) vulnerability in ruby net-imap. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 42.9% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
0.52%
0%100%
Low · +0.22 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 9 · Related 2Timeline
- 09-05-2026PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
CVSS metrics
9 scores · 7 sources · 2 versionsMedium 6.0Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · RubygemsEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
+0.22 pp
From 0.30% on 19-09-2026
19-09-202619-10-2026
EPSS score0.52%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
- CWE-1322Use of Blocking Code in Single-threaded, Non-blocking ContextThe product uses a non-blocking model that relies on a single threaded process for features such as scalability, but it contains code that can block when it is invoked.
Affected systems
Chainguard58 products
- gitlab-rails-ce-18.1< 18.1.6-r10
- gitlab-rails-ce-18.10< 18.10.5-r1
- gitlab-rails-ce-18.11< 18.11.3-r1
- gitlab-rails-ce-18.3All versions (No fix recorded)
- gitlab-rails-ce-18.4All versions (No fix recorded)
Wolfi14 products
- jruby-10.1< 10.1.1.0-r1
- logstash-9.3< 9.3.4-r1
- logstash-9.3-iamguarded-compat< 9.3.4-r1
- logstash-9.3-with-output-opensearch< 9.3.4-r1
- ruby3.2-kube-logging-operator-fluentd-outputs< 6.5.0-r2
Debian2 products
- ruby3.1All versions (No fix recorded)
- ruby3.3All versions (No fix recorded)
Suse2 products
- rmt-server&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP7< 3.1.0-150700.3.28.1
- rmt-server&distro=SUSE Linux Enterprise Module for Server Applications 15 SP7< 3.1.0-150700.3.28.1
Ubuntu2 products
- jrubyAll versions (No fix recorded)
- ruby3.3All versions (No fix recorded) | < 3.3.8-2ubuntu3.1
Opensuse1 product
- rmt-server&distro=openSUSE Leap 16.0< 3.0.0-160000.1.1
Ruby1 product
- net-imap≥ 0.4.0, < 0.4.24 | ≥ 0.5.0, < 0.5.14 | ≥ 0.6.0, < 0.6.4
RubyGems1 product
- net-imap≥ 0.6.0, < 0.6.4 | ≥ 0.5.0, < 0.5.14 | ≥ 0.4.0, < 0.4.24
8 vendors · 81 products
References
30 links- github.com/ruby/net-imap/security/advisories/GHSA-87pf-fpwv-p7m7X Refsource CONFIRMREPORTAdvisoryWEBMitigationVendor Advisory
- github.com/ruby/net-imap/commit/158d0b505074397cdb5ceb58935e42dd2bcfa612X Refsource MISCREPORTFIXWEBPatch
- github.com/ruby/net-imap/commit/808001bc45c06f7297a7e96d341279e041a7f7f4X Refsource MISCREPORTFIXWEBPatch
- github.com/ruby/net-imap/commit/99f59eab6064955a23debd95410263ad144df758X Refsource MISCREPORTFIXWEBPatch
Show all 30 references
- github.com/ruby/net-imapPACKAGE