← Vulnerability feed

Vulnerability record · CVE-2026-42245 · published 9 May 2026

CVE-2026-42245: Ruby-lang net\ vulnerability

Ruby Lang · Net\

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

2.3 CVSS 4.0 Low EPSS 0.70% · top 48.7% CWE-407 · CWE-407
2.3CVSS 4.0 base score
0.70%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
7References
24 Jul 2026Last modified by NVD

Description

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/ruby/net-imap/commit/6091f7d6b1f3514cafbfe39c76f2b5d73de3ca96 Patch
https://github.com/ruby/net-imap/commit/88d95231fc8afef11c1f074453f7d75b68c9dfda Patch
https://github.com/ruby/net-imap/commit/de685f91a4a4cc75eb80da898c2bf8af08d34819 Patch
https://github.com/ruby/net-imap/releases/tag/v0.4.24 Release Notes
https://github.com/ruby/net-imap/releases/tag/v0.5.14 Release Notes
https://github.com/ruby/net-imap/releases/tag/v0.6.4 Release Notes
https://github.com/ruby/net-imap/security/advisories/GHSA-q2mw-fvj9-vvcw MitigationVendor Advisory

Track CVE-2026-42245 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.6CVE-2026-42246Ruby-lang net\ vulnerabilityNet::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man…EPSS 0.40%6.0CVE-2026-42256Ruby-lang net\ allocation without limits vulnerabilityNet::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.…EPSS 0.52%6.0CVE-2025-43857Ruby-lang net\ uncontrolled resource consumption vulnerabilityNet::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there i…EPSS 0.49%5.8CVE-2026-42257Ruby-lang net\ command injection vulnerabilityNet::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::…EPSS 0.52%5.8CVE-2026-42258Ruby-lang net\ command injection vulnerabilityNet::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol argume…EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2026-42245), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.