CVE-2026-42258: ruby net-imap Command Injection
CVSS: 7.1v3.1HighModified
AliasesUBUNTU-CVE-2026-42258DEBIAN-CVE-2026-42258CGA-26w7-5r94-hgj5CGA-4f82-p6p8-h8gwCGA-53ph-wpg6-5j3fCGA-8g95-phgm-6339CGA-93mr-qq34-h7v2CGA-959f-2wxc-3w58CGA-9g4r-hq24-7w3rCGA-9j4h-3q4m-mg74CGA-9m7p-293f-pfv2CGA-9v27-9564-mjvxCGA-c3pg-q79h-wwvjCGA-f749-v2mv-m264CGA-frm8-hmr4-622qCGA-g2hx-pqvj-jrpvCGA-gjc8-cp3f-37qhCGA-h83f-7mm2-crgwCGA-hm9r-4v3x-xp9jCGA-jrqc-3fh2-57wfCGA-m533-m6vw-c85pCGA-mp7g-c377-99c7CGA-mrc3-4h48-2gm9CGA-mwmw-jcgg-hrhwCGA-q72v-h356-37vqCGA-r32m-w7vv-xgmhCGA-r38m-p5wx-4pwqCGA-v97c-7hr3-3m23CGA-vfc3-5g8h-fcw2CGA-vpm9-3vh3-wg2cCGA-vpwc-5qjp-r8wjCGA-w97h-g52w-2x7wCGA-w97p-m5qj-8v46CGA-x55j-66qh-73qrCGA-233w-8jg4-cvf8CGA-272f-q79f-hw9mCGA-287m-xrg4-vf3fCGA-2fh7-pg6h-pcr9CGA-2rhc-r22f-m3rjCGA-365v-96r6-273jCGA-3894-5vpp-829gCGA-38vp-mrhx-c6gcCGA-3rfg-xxw9-w396CGA-3rmx-xc8j-rqvcCGA-557j-m2pf-5p44CGA-55mg-fmj7-g8j2CGA-55qr-rh2w-pvc9CGA-5vr6-v233-h582CGA-5x98-hvcf-5mw9CGA-664c-399x-p493CGA-6737-cvcq-39rqCGA-67vv-6mxc-r8h7CGA-6gfx-j4cj-2c39CGA-6pwc-wfwp-6mrmCGA-6qmx-7627-xmxqCGA-72m8-2f3c-8cx5CGA-7734-6mhg-h3wxCGA-7crx-g3mq-rv57CGA-827p-h5f9-wcmcCGA-83hw-8395-f7v4CGA-83qv-6vwv-v7qwCGA-845h-hvwx-9848CGA-86wf-h2fj-7jr3CGA-895h-rr55-c6j9CGA-8g8j-49cg-4gg2CGA-8hwg-qmv3-r9hjCGA-8xmr-m95v-7f2rCGA-927x-m459-rv92CGA-9q5v-7p4q-xmr5CGA-9x5r-fxv4-3g9wCGA-c374-fm5r-62xqCGA-c3vv-3mfc-42jwCGA-c5hf-5269-4cxrCGA-c6p8-jq32-q7hcCGA-c7mq-vqrq-g25mCGA-cm36-9h9v-p7j5CGA-crvf-73x8-qgm7CGA-cxq2-85f6-9wh9CGA-f28q-qw74-cmjfCGA-f49r-fw9c-3rp8CGA-ffmc-h4fm-6qf6CGA-fh45-6fgh-m5h6CGA-fp96-f3ph-h6h9CGA-fw44-2mjf-h5x5CGA-fwhf-529g-2wxhCGA-g7hc-6332-m69hCGA-g7vp-xv3q-3wqqCGA-ghc8-4c7v-hgv4CGA-gjcx-6qwc-v629CGA-gjfx-5fq9-h233CGA-gp85-g763-qp77CGA-gq88-32gj-4hcqCGA-gvwg-q74h-79m9CGA-gx4g-jgw4-v7j4CGA-hmmc-w5pc-63rvCGA-hpgp-wc6f-42jfCGA-j75g-vjr2-g6mgCGA-jhhg-g5vh-q9j2CGA-jwh5-53wr-w95mCGA-m856-4mq2-x763CGA-mc9c-8rmc-2cgmCGA-mcgv-x6fq-q843CGA-mch7-hw94-9g94CGA-mhpq-vxm9-j5p5CGA-mwpv-mjpv-vv2xCGA-mx2r-xqhw-x729CGA-mx7m-226w-jcqcCGA-p4hw-mrmx-hjrcCGA-p4rg-8wfh-vm92CGA-p7pm-hjpr-3xvwCGA-p8w5-829c-292gCGA-pgw8-x676-6gw6CGA-pjjg-hw97-9f9xCGA-pw66-9vff-2cj7GHSA-75xq-5h9v-w6pxCGA-pxf7-g5mj-pvcpCGA-qc38-j8xq-3x6cCGA-qg8g-457c-4h7pCGA-qvmr-63wx-6c36CGA-r75p-q7vw-w7m6CGA-rx78-xm9q-mcg2CGA-v422-jq5q-hjghCGA-v67f-55vv-gqxxCGA-vm8g-r98w-256fCGA-vp5g-h66g-6879CGA-vwfr-f59w-36w9CGA-vx25-gc5v-fc53CGA-w49w-7v2x-mqqhCGA-w8c6-q8rx-xvrxCGA-wggh-c43j-4wcjCGA-x4cf-6569-xqc5CGA-x65p-fg68-5r6jCGA-xg7j-c6vw-hw47CGA-xmfx-7f4r-p8p7CGA-xqwv-6472-jxq2CGA-xx78-34xv-qv87
Published 09-05-2026Last modified 01-09-2026
Vulnerability summary
CVE-2026-42258 is a high (CVSS 7.1) Command Injection vulnerability in ruby net-imap. EPSS estimates a 1.25% chance of exploitation in the next 30 days, higher than 69% of scored vulnerabilities.
CVSS score
7.1/10
010
High · v3.1 (CVE.org)EPSS score
1.25%
0%100%
Low · +0.47 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 24 · Related 4OPENSUSE-SU-2026:21878-1RHSA-2026:33462RHSA-2026:33512RHSA-2026:33514RHSA-2026:33515RHSA-2026:33540RHSA-2026:33565RHSA-2026:33576RHSA-2026:33577RHSA-2026:33630RHSA-2026:34076RHSA-2026:35447RHSA-2026:35834RHSA-2026:35866RHSA-2026:35867RHSA-2026:35895RHSA-2026:36099RHSA-2026:36978RHSA-2026:37238RHSA-2026:37397RHSA-2026:38694RHSA-2026:40380SUSE-SU-2026:3090-1USN-8556-1CGA-9JR7-PGP6-QF4V
Timeline
- 09-05-2026PublishedVulnerability first disclosed.
- 01-09-2026Last modifiedVulnerability information updated.
Description
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
CVSS metrics
11 scores · 7 sources · 2 versionsMedium 5.8Preferred score · CVE.org (CNA)
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated5.8MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated5.8MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated5.8MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
- OSV · RubygemsEcosystem advisory · calculated5.8MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
- NVDNIST5.8MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:NSources5 sources · 5.3–7.1
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:LDiffers
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:LDiffers
- OSV · RubygemsEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:LDiffers
- NVDNIST5.3MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:LDiffers
EPSS trend
Probability
1.25%
Chance of exploitation in the next 30 days
Percentile
69%
Versus all other CVEs
30-day change
+0.47 pp
From 0.78% on 19-09-2026
19-09-202619-10-2026
EPSS score1.25%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
- CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Affected systems
Chainguard60 products
- gitlab-rails-ce-18.1< 18.1.6-r10
- gitlab-rails-ce-18.10< 18.10.5-r1
- gitlab-rails-ce-18.11< 18.11.3-r1
- gitlab-rails-ce-18.3All versions (No fix recorded)
- gitlab-rails-ce-18.4All versions (No fix recorded)
Wolfi16 products
- jruby-10.1< 10.1.1.0-r1
- jruby-9.4< 9.4.15.0-r2
- kube-fluentd-operator< 1.18.2-r70
- logstash-9.3< 9.3.4-r1
- logstash-9.3-iamguarded-compat< 9.3.4-r1
Ubuntu7 products
- jrubyAll versions (No fix recorded)
- ruby2.3< 2.3.1-2~ubuntu16.04.16+esm15
- ruby2.5All versions (No fix recorded)
- ruby2.7All versions (No fix recorded)
- ruby3.0All versions (No fix recorded)
Debian2 products
- ruby3.1All versions (No fix recorded)
- ruby3.3All versions (No fix recorded)
Ruby1 product
- net-imap< 0.4.24 | ≥ 0.5.0, < 0.5.14 | ≥ 0.6.0, < 0.6.4
RubyGems1 product
- net-imap≥ 0.6.0, < 0.6.4 | ≥ 0.5.0, < 0.5.14 | < 0.4.24
6 vendors · 87 products
References
40 links- github.com/ruby/net-imap/security/advisories/GHSA-75xq-5h9v-w6pxX Refsource CONFIRMREPORTAdvisoryWEBMitigationVendor Advisory
Show all 40 references
- github.com/ruby/net-imapPACKAGE