CVE-2026-42257: ruby net-imap Command Injection
CVSS: 9.8v3.1CriticalAnalyzed
AliasesUBUNTU-CVE-2026-42257DEBIAN-CVE-2026-42257CGA-2c3h-vr82-mrx9CGA-2c3p-5r4g-rcccCGA-2qgf-69r9-j676CGA-3wfv-48rx-6vg4CGA-4v2p-rx5q-pwwmCGA-4x88-5qc3-m67vCGA-59qp-whr2-gxvgCGA-5rmc-p74j-5vxpCGA-6f62-3gwf-4v5fCGA-6ghv-hcjm-6cpjCGA-6gj9-pqcp-r43vCGA-6m5m-9qff-5qffCGA-737q-5hvw-gr8gCGA-7vpj-q2g7-x95wCGA-85ch-xf79-j952CGA-89vx-gjqc-q7pwCGA-94xx-v8vg-g4c9CGA-c8w9-3fc9-w35wCGA-fhr3-6vc4-r9rjCGA-j4p4-wx8c-wchpCGA-jffm-5hg2-32cjCGA-jhmc-8w89-ccqjCGA-mv7f-x7fj-6xhxCGA-p4m8-76v6-29rgCGA-qc79-j79p-x394CGA-qg43-f46x-jcphCGA-rfvc-hxrv-r7wwCGA-rmw8-wr66-8xcvCGA-rvvv-m82q-g92qCGA-x6cv-wwmq-cx7mCGA-xrh7-rm44-3h39CGA-xv2h-cvx3-rchvCGA-23hp-f396-fhj4CGA-2579-rvj9-j3qmCGA-2f88-489m-27r5CGA-2x5j-g26q-rh7wCGA-35fm-wr5x-wc77CGA-36vr-2pjm-jvqmCGA-3f79-hj2f-jqhrCGA-3fcf-hf5j-89hrCGA-3ghg-4jgg-jw6fCGA-3grj-xvmm-ff2gCGA-3pp8-p27q-6qv7CGA-3vm6-7v9x-v2fxCGA-3xp3-mggx-vj7pCGA-428j-cvq4-v5f3CGA-43mq-gw98-v2qhCGA-4j7x-96g3-q9c4CGA-4m7x-4wx5-fjw4CGA-4mfh-wqrw-gfrrCGA-4qw7-5f4p-rvp3CGA-4w6j-3q5p-p8vjCGA-57j6-p984-h65jCGA-5cr6-33wj-2h79CGA-5f6r-x4f5-28h2CGA-5vvv-6vc9-475rCGA-67f5-wf32-2jrwCGA-67pv-5cww-9v93CGA-6h85-cw5f-hfqjCGA-6v7p-7hf6-jpgjCGA-7gcv-j329-964mCGA-7gjj-386h-wwg8CGA-7hj9-43jf-5gvpCGA-7j8f-rc8q-hc7fCGA-84hq-j9v9-3596CGA-8p6m-97q9-75hgCGA-8q58-7m33-rq7hCGA-9c6h-67jx-frx4CGA-9fjj-mgxm-gr66CGA-9rqv-334p-x8x7CGA-9x43-6v4m-385gCGA-c42p-3q43-jw23CGA-c4wp-9rw5-fmrfCGA-c62q-g993-5jxqCGA-c6cx-r9mv-29prCGA-c8vq-93pw-fjvpCGA-c945-w8mr-wq9fCGA-c95r-c6fx-v6fcCGA-cfjq-v8v4-5f5hCGA-cw64-x6xh-3rh4CGA-fj58-39cp-jmh9CGA-fj7p-c344-h5xjCGA-fx2f-vmpw-g9jmCGA-gcf9-rpj5-v2jxCGA-gh36-jm4w-v237CGA-ghr5-5phh-pw55CGA-gpqr-r6vp-538jCGA-gvwf-6gpv-5m2gCGA-gw39-8fqj-6x3mCGA-gwfx-hpv8-5hv7CGA-h85g-vx7r-m2q5CGA-hg3q-p898-j35qCGA-hpjf-p64x-2cm8CGA-jhw4-8qc4-22c3CGA-jrfp-m49c-w4r6CGA-jrjx-56cc-92f4CGA-jrwh-f4x7-73hhCGA-jw2x-vqp3-5mrrCGA-mhmj-8cmp-5g6qCGA-p96h-mv2j-8p65CGA-pc8v-q37w-79jgCGA-pc9w-vwr5-7g8qCGA-pfp9-wmwf-8j6hCGA-pjr4-636p-cj54CGA-ppjq-5q3q-cv7wCGA-pr6j-x38x-7gw5CGA-prfj-3j43-ffh6GHSA-hm49-wcqc-g2xgCGA-q3xc-p7wr-j3hpCGA-qj23-j8hv-2rr3CGA-qq4p-h44p-h8fwCGA-qrc8-43q6-54jqCGA-qxh3-6rm6-gv9vCGA-r4cx-wv9p-w59gCGA-r96r-w8qj-j52jCGA-r97v-p35g-wpw8CGA-r9wq-p7g6-684pCGA-rhqc-jcfj-5mrcCGA-rj26-99qj-q6pcCGA-rp42-8mqh-5xxgCGA-v364-974q-m2wpCGA-v632-987g-9x37CGA-v86p-5xh5-q9vfCGA-vcc7-fpch-qv5hCGA-vfmr-vvwr-r746CGA-vhp8-x46c-f94pCGA-vjx2-ph35-5rvpCGA-w349-rj57-x3q4CGA-whc4-88vw-7q7mCGA-wpjj-rgj3-q486CGA-wwvg-f824-fhmxCGA-x3h6-7567-22qmCGA-x3wx-xp5v-2fjqCGA-x828-575m-4vqq
Published 09-05-2026Last modified 13-05-2026
Vulnerability summary
CVE-2026-42257 is a critical (CVSS 9.8) Command Injection vulnerability in ruby net-imap. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 42.9% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
0.52%
0%100%
Low · +0.09 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 9 · Related 3Timeline
- 09-05-2026PublishedVulnerability first disclosed.
- 13-05-2026Last modifiedVulnerability information updated.
Description
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
CVSS metrics
9 scores · 7 sources · 2 versionsMedium 5.8Preferred score · CVE.org (CNA)
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated5.8MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated5.8MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated5.8MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
- OSV · RubygemsEcosystem advisory · calculated5.8MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
- NVDNIST5.8MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Critical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
+0.09 pp
From 0.43% on 19-09-2026
19-09-202619-10-2026
EPSS score0.52%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
- CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Affected systems
Chainguard60 products
- gitlab-rails-ce-18.1< 18.1.6-r10
- gitlab-rails-ce-18.10< 18.10.5-r1
- gitlab-rails-ce-18.11< 18.11.3-r1
- gitlab-rails-ce-18.3All versions (No fix recorded)
- gitlab-rails-ce-18.4All versions (No fix recorded)
Wolfi16 products
- jruby-10.1< 10.1.1.0-r1
- jruby-9.4< 9.4.15.0-r2
- kube-fluentd-operator< 1.18.2-r70
- logstash-9.3< 9.3.4-r1
- logstash-9.3-iamguarded-compat< 9.3.4-r1
Ubuntu7 products
- jrubyAll versions (No fix recorded)
- ruby2.3< 2.3.1-2~ubuntu16.04.16+esm14
- ruby2.5< 2.5.1-1ubuntu1.16+esm8
- ruby2.7< 2.7.0-5ubuntu1.18+esm5
- ruby3.0< 3.0.2-7ubuntu2.13
Debian2 products
- ruby3.1All versions (No fix recorded)
- ruby3.3All versions (No fix recorded)
Ruby1 product
- net-imap< 0.4.24 | ≥ 0.5.0, < 0.5.14 | ≥ 0.6.0, < 0.6.4
RubyGems1 product
- net-imap≥ 0.6.0, < 0.6.4 | ≥ 0.5.0, < 0.5.14 | < 0.4.24
6 vendors · 87 products
References
18 links- github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xgX Refsource CONFIRMREPORTAdvisoryWEBMitigationVendor Advisory
Show all 18 references
- github.com/ruby/net-imapPACKAGE