CVE-2026-42245

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ruby/net-imap/commit/6091f7d6b1f3514cafbfe39c76f2b5d73de3ca96	Patch
https://github.com/ruby/net-imap/commit/88d95231fc8afef11c1f074453f7d75b68c9dfda	Patch
https://github.com/ruby/net-imap/commit/de685f91a4a4cc75eb80da898c2bf8af08d34819	Patch
https://github.com/ruby/net-imap/releases/tag/v0.4.24	Release Notes
https://github.com/ruby/net-imap/releases/tag/v0.5.14	Release Notes
https://github.com/ruby/net-imap/releases/tag/v0.6.4	Release Notes
https://github.com/ruby/net-imap/security/advisories/GHSA-q2mw-fvj9-vvcw	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ruby-lang:net\:\:imap::::::ruby::*
	cpe:2.3:a:ruby-lang:net\:\:imap::::::ruby::*
	cpe:2.3:a:ruby-lang:net\:\:imap::::::ruby::*

History

No history.

Information

Published : 2026-05-09 20:16

Updated : 2026-07-24 19:10

NVD link : CVE-2026-42245

Mitre link : CVE-2026-42245

CVE.ORG link : CVE-2026-42245

JSON object : View

Products Affected

ruby-lang

net\

CWE

CWE-407

Inefficient Algorithmic Complexity

{"id": "CVE-2026-42245", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42245", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T17:53:55.917796Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ruby", "product": "net-imap", "versions": [{"status": "affected", "version": "< 0.4.24"}, {"status": "affected", "version": ">= 0.5.0, < 0.5.14"}, {"status": "affected", "version": ">= 0.6.0, < 0.6.4"}]}]}], "published": "2026-05-09T20:16:28.017", "references": [{"url": "https://github.com/ruby/net-imap/commit/6091f7d6b1f3514cafbfe39c76f2b5d73de3ca96", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/net-imap/commit/88d95231fc8afef11c1f074453f7d75b68c9dfda", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/net-imap/commit/de685f91a4a4cc75eb80da898c2bf8af08d34819", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/net-imap/releases/tag/v0.4.24", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/net-imap/releases/tag/v0.5.14", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/net-imap/releases/tag/v0.6.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/net-imap/security/advisories/GHSA-q2mw-fvj9-vvcw", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-407"}]}], "descriptions": [{"lang": "en", "value": "Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4."}, {"lang": "es", "value": "Net::IMAP implementa la funcionalidad de cliente del Protocolo de Acceso a Mensajes de Internet (IMAP) en Ruby. Antes de las versiones 0.4.24, 0.5.14 y 0.6.4, Net::IMAP::ResponseReader tiene una complejidad temporal cuadr\u00e1tica al leer respuestas grandes que contienen muchos literales de cadena. Un servidor hostil puede enviar respuestas dise\u00f1adas para agotar la CPU del cliente para un ataque de denegaci\u00f3n de servicio. Este problema ha sido parcheado en las versiones 0.4.24, 0.5.14 y 0.6.4."}], "lastModified": "2026-07-24T19:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "05DB8FF3-7546-470A-BBB4-4DCAEAD83D6F", "versionEndExcluding": "0.4.24"}, {"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "2CCEB891-1D8F-4431-A79C-2A7560A84F4E", "versionEndExcluding": "0.5.14", "versionStartIncluding": "0.5.0"}, {"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "9A6D1995-BFA3-490F-967D-252CA7BE2264", "versionEndExcluding": "0.6.4", "versionStartIncluding": "0.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}