CVE-2026-47242: ruby net-imap Command Injection

CVSS: 5.8v4.0MediumDeferred

AliasesRHSA-2026:54391RHSA-2026:54393RHSA-2026:54416+119 more

Published 22-06-2026Last modified 23-06-2026

Vulnerability summary

CVE-2026-47242 is a medium (CVSS 5.8) Command Injection vulnerability in ruby net-imap. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.4% of scored vulnerabilities.

Overall risk

23/100

0100

Low · default modelHow is this calculated?

CVSS score

5.8/10

010

Medium · v4.0 (CVE.org)

EPSS score

0.18%

0%100%

Low · +0.05 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 3

OPENSUSE-SU-2026:21878-1 RHSA-2026:33551 RHSA-2026:34293 RHSA-2026:38694 RHSA-2026:40380 RHSA-2026:50728+6 more

Timeline

22-06-2026
PublishedVulnerability first disclosed.
23-06-2026
Last modifiedVulnerability information updated.

Description

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAP#id is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences. While Net::IMAP#enable does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The #to_s value is sent verbatim. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands. This vulnerability is fixed in 0.6.5 and 0.5.15.

CVSS metrics

8 scores · 8 sources · 2 versions

v4.05.8v3.17.3

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

Versus all other CVEs

30-day change

+0.05 pp

From 0.13% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard53 products

gitlab-rails-ce-18.1All versions (No fix recorded)
gitlab-rails-ce-18.10All versions (No fix recorded)
gitlab-rails-ce-18.11< 18.11.5-r0
gitlab-rails-ce-18.4All versions (No fix recorded)
gitlab-rails-ce-18.5All versions (No fix recorded)

Show all 53

Redhat42 products

ruby< 0:3.3.12-11.el10_0.3 | < 0:3.3.12-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.3.12-6.module+el9.6.0+24618+75aeb29f.1
ruby-bundled-gems< 0:3.3.12-11.el10_0.3 | < 0:3.3.12-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.3.12-6.module+el9.6.0+24618+75aeb29f.1
ruby-bundled-gems-debuginfo< 0:3.3.12-11.el10_0.3 | < 0:3.3.12-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.3.12-6.module+el9.6.0+24618+75aeb29f.1
ruby-debuginfo< 0:3.3.12-11.el10_0.3 | < 0:3.3.12-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.3.12-6.module+el9.6.0+24618+75aeb29f.1
ruby-debugsource< 0:3.3.12-11.el10_0.3 | < 0:3.3.12-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.3.12-6.module+el9.6.0+24618+75aeb29f.1

ruby-default-gems< 0:3.3.12-11.el10_0.3 | < 0:3.3.12-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.3.12-6.module+el9.6.0+24618+75aeb29f.1
ruby-devel< 0:3.3.12-11.el10_0.3 | < 0:3.3.12-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.3.12-6.module+el9.6.0+24618+75aeb29f.1
ruby-doc< 0:3.3.12-11.el10_0.3 | < 0:3.3.12-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.3.12-6.module+el9.6.0+24618+75aeb29f.1
ruby-libs< 0:3.3.12-11.el10_0.3 | < 0:3.3.12-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.3.12-6.module+el9.6.0+24618+75aeb29f.1
ruby-libs-debuginfo< 0:3.3.12-11.el10_0.3 | < 0:3.3.12-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.3.12-6.module+el9.6.0+24618+75aeb29f.1
rubygem-bigdecimal< 0:3.1.5-11.el10_0.3 | < 0:3.1.5-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.1.5-6.module+el9.6.0+24618+75aeb29f.1
rubygem-bigdecimal-debuginfo< 0:3.1.5-11.el10_0.3 | < 0:3.1.5-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.1.5-6.module+el9.6.0+24618+75aeb29f.1
rubygem-bundler< 0:2.5.22-11.el10_0.3 | < 0:2.5.22-7.module+el9.4.0+24628+a370c2b9.2 | < 0:2.5.22-6.module+el9.6.0+24618+75aeb29f.1
rubygem-io-console< 0:0.7.1-11.el10_0.3 | < 0:0.7.1-7.module+el9.4.0+24628+a370c2b9.2 | < 0:0.7.1-6.module+el9.6.0+24618+75aeb29f.1
rubygem-io-console-debuginfo< 0:0.7.1-11.el10_0.3 | < 0:0.7.1-7.module+el9.4.0+24628+a370c2b9.2 | < 0:0.7.1-6.module+el9.6.0+24618+75aeb29f.1
rubygem-irb< 0:1.13.1-11.el10_0.3 | < 0:1.13.1-7.module+el9.4.0+24628+a370c2b9.2 | < 0:1.13.1-6.module+el9.6.0+24618+75aeb29f.1
rubygem-json< 0:2.7.2-11.el10_0.3 | < 0:2.7.2-7.module+el9.4.0+24628+a370c2b9.2 | < 0:2.7.2-6.module+el9.6.0+24618+75aeb29f.1
rubygem-json-debuginfo< 0:2.7.2-11.el10_0.3 | < 0:2.7.2-7.module+el9.4.0+24628+a370c2b9.2 | < 0:2.7.2-6.module+el9.6.0+24618+75aeb29f.1
rubygem-minitest< 0:5.20.0-11.el10_0.3 | < 0:5.20.0-7.module+el9.4.0+24628+a370c2b9.2 | < 0:5.20.0-6.module+el9.6.0+24618+75aeb29f.1
rubygem-mysql2< 0:0.5.5-1.module+el9.4.0+21222+faeeed2f
rubygem-mysql2-debuginfo< 0:0.5.5-1.module+el9.4.0+21222+faeeed2f
rubygem-mysql2-debugsource< 0:0.5.5-1.module+el9.4.0+21222+faeeed2f
rubygem-mysql2-doc< 0:0.5.5-1.module+el9.4.0+21222+faeeed2f
rubygem-pg< 0:1.5.4-1.module+el9.4.0+21222+faeeed2f
rubygem-pg-debuginfo< 0:1.5.4-1.module+el9.4.0+21222+faeeed2f
rubygem-pg-debugsource< 0:1.5.4-1.module+el9.4.0+21222+faeeed2f
rubygem-pg-doc< 0:1.5.4-1.module+el9.4.0+21222+faeeed2f
rubygem-power_assert< 0:2.0.3-11.el10_0.3 | < 0:2.0.3-7.module+el9.4.0+24628+a370c2b9.2 | < 0:2.0.3-6.module+el9.6.0+24618+75aeb29f.1
rubygem-psych< 0:5.1.2-11.el10_0.3 | < 0:5.1.2-7.module+el9.4.0+24628+a370c2b9.2 | < 0:5.1.2-6.module+el9.6.0+24618+75aeb29f.1
rubygem-psych-debuginfo< 0:5.1.2-11.el10_0.3 | < 0:5.1.2-7.module+el9.4.0+24628+a370c2b9.2 | < 0:5.1.2-6.module+el9.6.0+24618+75aeb29f.1
rubygem-racc< 0:1.7.3-11.el10_0.3 | < 0:1.7.3-7.module+el9.4.0+24628+a370c2b9.2 | < 0:1.7.3-6.module+el9.6.0+24618+75aeb29f.1
rubygem-racc-debuginfo< 0:1.7.3-11.el10_0.3 | < 0:1.7.3-7.module+el9.4.0+24628+a370c2b9.2 | < 0:1.7.3-6.module+el9.6.0+24618+75aeb29f.1
rubygem-rake< 0:13.1.0-11.el10_0.3 | < 0:13.1.0-7.module+el9.4.0+24628+a370c2b9.2 | < 0:13.1.0-6.module+el9.6.0+24618+75aeb29f.1
rubygem-rbs< 0:3.4.0-11.el10_0.3 | < 0:3.4.0-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.4.0-6.module+el9.6.0+24618+75aeb29f.1
rubygem-rbs-debuginfo< 0:3.4.0-11.el10_0.3 | < 0:3.4.0-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.4.0-6.module+el9.6.0+24618+75aeb29f.1
rubygem-rdoc< 0:6.6.3.1-11.el10_0.3 | < 0:6.6.3.1-7.module+el9.4.0+24628+a370c2b9.2 | < 0:6.6.3.1-6.module+el9.6.0+24618+75aeb29f.1
rubygem-rexml< 0:3.4.4-11.el10_0.3 | < 0:3.4.4-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.4.4-6.module+el9.6.0+24618+75aeb29f.1
rubygem-rss< 0:0.3.1-11.el10_0.3 | < 0:0.3.1-7.module+el9.4.0+24628+a370c2b9.2 | < 0:0.3.1-6.module+el9.6.0+24618+75aeb29f.1
rubygem-test-unit< 0:3.6.1-11.el10_0.3 | < 0:3.6.1-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.6.1-6.module+el9.6.0+24618+75aeb29f.1
rubygem-typeprof< 0:0.21.9-11.el10_0.3 | < 0:0.21.9-7.module+el9.4.0+24628+a370c2b9.2 | < 0:0.21.9-6.module+el9.6.0+24618+75aeb29f.1
rubygems< 0:3.5.22-11.el10_0.3 | < 0:3.5.22-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.5.22-6.module+el9.6.0+24618+75aeb29f.1
rubygems-devel< 0:3.5.22-11.el10_0.3 | < 0:3.5.22-7.module+el9.4.0+24628+a370c2b9.2 | < 0:3.5.22-6.module+el9.6.0+24618+75aeb29f.1

Show all 42

Wolfi13 products

jruby-10.1< 10.1.1.0-r1
jruby-9.4< 9.4.15.0-r3
kube-fluentd-operator< 1.18.2-r70
logstash-9.3< 9.3.6-r0
logstash-9.3-iamguarded-compat< 9.3.6-r0

Show all 13

Ubuntu7 products

jrubyAll versions (No fix recorded)
ruby2.3All versions (No fix recorded)
ruby2.5All versions (No fix recorded)
ruby2.7All versions (No fix recorded)
ruby3.0All versions (No fix recorded)

Show all 7

Debian2 products

ruby3.1All versions (No fix recorded)
ruby3.3All versions (No fix recorded)

Ruby1 product

net-imap≥ 0.6.0, < 0.6.4.1 | < 0.5.15

RubyGems1 product

net-imap≥ 0.6.0, < 0.6.4.1 | < 0.5.15

7 vendors · 119 products

References

18 links

github.com/ruby/net-imap/security/advisories/GHSA-46q3-7gv7-qmggX Refsource CONFIRMARTICLEREPORTAdvisoryWEB
access.redhat.com/errata/RHSA-2026:54391Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2491522REPORT
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54391.jsonAdvisory
access.redhat.com/security/cve/CVE-2026-47242REPORT
www.cve.org/CVERecord?id=CVE-2026-47242AdvisoryREPORTWEB
nvd.nist.gov/vuln/detail/CVE-2026-47242Advisory
access.redhat.com/errata/RHSA-2026:54393Advisory
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54393.jsonAdvisory

Show all 18 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities