CVE-2026-42256

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ruby/net-imap/commit/158d0b505074397cdb5ceb58935e42dd2bcfa612	Patch
https://github.com/ruby/net-imap/commit/808001bc45c06f7297a7e96d341279e041a7f7f4	Patch
https://github.com/ruby/net-imap/commit/99f59eab6064955a23debd95410263ad144df758	Patch
https://github.com/ruby/net-imap/releases/tag/v0.4.24	Release Notes
https://github.com/ruby/net-imap/releases/tag/v0.5.14	Release Notes
https://github.com/ruby/net-imap/releases/tag/v0.6.4	Release Notes
https://github.com/ruby/net-imap/security/advisories/GHSA-87pf-fpwv-p7m7	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ruby-lang:net\:\:imap::::::ruby::*
	cpe:2.3:a:ruby-lang:net\:\:imap::::::ruby::*
	cpe:2.3:a:ruby-lang:net\:\:imap::::::ruby::*

History

No history.

Information

Published : 2026-05-09 20:16

Updated : 2026-07-24 19:10

NVD link : CVE-2026-42256

Mitre link : CVE-2026-42256

CVE.ORG link : CVE-2026-42256

JSON object : View

Products Affected

ruby-lang

net\

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

CWE-1322

Use of Blocking Code in Single-threaded, Non-blocking Context

{"id": "CVE-2026-42256", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42256", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T17:04:26.784816Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ruby", "product": "net-imap", "versions": [{"status": "affected", "version": ">= 0.4.0, < 0.4.24"}, {"status": "affected", "version": ">= 0.5.0, < 0.5.14"}, {"status": "affected", "version": ">= 0.6.0, < 0.6.4"}]}]}], "published": "2026-05-09T20:16:28.313", "references": [{"url": "https://github.com/ruby/net-imap/commit/158d0b505074397cdb5ceb58935e42dd2bcfa612", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/net-imap/commit/808001bc45c06f7297a7e96d341279e041a7f7f4", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/net-imap/commit/99f59eab6064955a23debd95410263ad144df758", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/net-imap/releases/tag/v0.4.24", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/net-imap/releases/tag/v0.5.14", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/net-imap/releases/tag/v0.6.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/net-imap/security/advisories/GHSA-87pf-fpwv-p7m7", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}, {"lang": "en", "value": "CWE-1322"}]}], "descriptions": [{"lang": "en", "value": "Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4."}, {"lang": "es", "value": "Net::IMAP implementa la funcionalidad de cliente del Protocolo de Acceso a Mensajes de Internet (IMAP) en Ruby. Desde las versiones 0.4.0 hasta antes de la 0.4.24, 0.5.0 hasta antes de la 0.5.14, y 0.6.0 hasta antes de la 0.6.4, al autenticar una conexi\u00f3n con SCRAM-SHA1 o SCRAM-SHA256, un servidor hostil puede realizar un ataque de denegaci\u00f3n de servicio computacional en el proceso del cliente al enviar un valor de recuento de iteraciones grande. Este problema ha sido parcheado en las versiones 0.4.24, 0.5.14 y 0.6.4."}], "lastModified": "2026-07-24T19:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "79EE9345-B825-40F9-9CFF-9E9E1A3783DD", "versionEndExcluding": "0.4.24", "versionStartIncluding": "0.4.0"}, {"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "2CCEB891-1D8F-4431-A79C-2A7560A84F4E", "versionEndExcluding": "0.5.14", "versionStartIncluding": "0.5.0"}, {"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "9A6D1995-BFA3-490F-967D-252CA7BE2264", "versionEndExcluding": "0.6.4", "versionStartIncluding": "0.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}