CVE-2026-42246

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.
References
Link Resource
https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618 Patch
https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e Patch
https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c Patch
https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da Patch
https://github.com/ruby/net-imap/releases/tag/v0.3.10 Release Notes
https://github.com/ruby/net-imap/releases/tag/v0.4.24 Release Notes
https://github.com/ruby/net-imap/releases/tag/v0.5.14 Release Notes
https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp Mitigation Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:33462
https://access.redhat.com/errata/RHSA-2026:33512
https://access.redhat.com/errata/RHSA-2026:33514
https://access.redhat.com/errata/RHSA-2026:33515
https://access.redhat.com/errata/RHSA-2026:33540
https://access.redhat.com/errata/RHSA-2026:33551
https://access.redhat.com/errata/RHSA-2026:33552
https://access.redhat.com/errata/RHSA-2026:33565
https://access.redhat.com/errata/RHSA-2026:33576
https://access.redhat.com/errata/RHSA-2026:33577
https://access.redhat.com/errata/RHSA-2026:33630
https://access.redhat.com/errata/RHSA-2026:33721
https://access.redhat.com/errata/RHSA-2026:34076
https://access.redhat.com/errata/RHSA-2026:35834
https://access.redhat.com/errata/RHSA-2026:35866
https://access.redhat.com/errata/RHSA-2026:35867
https://access.redhat.com/errata/RHSA-2026:35895
https://access.redhat.com/errata/RHSA-2026:36099
https://access.redhat.com/errata/RHSA-2026:37238
https://access.redhat.com/errata/RHSA-2026:37397
https://access.redhat.com/security/cve/CVE-2026-42246
https://bugzilla.redhat.com/show_bug.cgi?id=2468499
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42246.json
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ruby-lang:net\:\:imap:*:*:*:*:*:ruby:*:*
cpe:2.3:a:ruby-lang:net\:\:imap:*:*:*:*:*:ruby:*:*
cpe:2.3:a:ruby-lang:net\:\:imap:*:*:*:*:*:ruby:*:*
cpe:2.3:a:ruby-lang:net\:\:imap:*:*:*:*:*:ruby:*:*

History

No history.

Information

Published : 2026-05-09 20:16

Updated : 2026-08-24 13:18


NVD link : CVE-2026-42246

Mitre link : CVE-2026-42246

CVE.ORG link : CVE-2026-42246


JSON object : View

Products Affected

ruby-lang

  • net\
CWE
CWE-392

Missing Report of Error Condition

CWE-393

Return of Wrong Status Code

CWE-636

Not Failing Securely ('Failing Open')

CWE-754

Improper Check for Unusual or Exceptional Conditions

CWE-841

Improper Enforcement of Behavioral Workflow

CWE-325

Missing Cryptographic Step