CVE-2026-47241

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and then sent verbatim. If this string is derived from user-controlled input, an attacker can force the next command to be absorbed as a continuation of the first command. This will cause the first command to eventually fail, but also prevents it from returning until another command is sent (from another thread). That other command will not return until the connection is closed. This vulnerability is fixed in 0.6.5 and 0.5.15.

CVSS

No CVSS.

References

Link	Resource
https://github.com/ruby/net-imap/security/advisories/GHSA-c4fp-cxrr-mj66

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Net::IMAP implementa la funcionalidad de cliente del Protocolo de Acceso a Mensajes de Internet (IMAP) en Ruby. Antes de 0.6.5 y 0.5.15, varios comandos de Net::IMAP aceptan un argumento de cadena sin procesar que solo se valida para prevenir la inyección de CRLF y luego se envía textualmente. Si esta cadena se deriva de una entrada controlada por el usuario, un atacante puede forzar que el siguiente comando sea absorbido como una continuación del primer comando. Esto hará que el primer comando falle eventualmente, pero también evita que regrese hasta que se envíe otro comando (desde otro hilo). Ese otro comando no regresará hasta que se cierre la conexión. Esta vulnerabilidad está corregida en 0.6.5 y 0.5.15.

Information

Published : 2026-06-22 21:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-47241

Mitre link : CVE-2026-47241

CVE.ORG link : CVE-2026-47241

JSON object : View

Products Affected

No product.

CWE

CWE-162

Improper Neutralization of Trailing Special Elements

CWE-182

Collapse of Data into Unsafe Value

CWE-186

Overly Restrictive Regular Expression

{"id": "CVE-2026-47241", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47241", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T14:16:22.874467Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ruby", "product": "net-imap", "versions": [{"status": "affected", "version": ">= 0.6.0, < 0.6.4.1"}, {"status": "affected", "version": "< 0.5.15"}]}]}], "published": "2026-06-22T21:16:24.677", "references": [{"url": "https://github.com/ruby/net-imap/security/advisories/GHSA-c4fp-cxrr-mj66", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-162"}, {"lang": "en", "value": "CWE-182"}, {"lang": "en", "value": "CWE-186"}]}], "descriptions": [{"lang": "en", "value": "Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and then sent verbatim. If this string is derived from user-controlled input, an attacker can force the next command to be absorbed as a continuation of the first command. This will cause the first command to eventually fail, but also prevents it from returning until another command is sent (from another thread). That other command will not return until the connection is closed. This vulnerability is fixed in 0.6.5 and 0.5.15."}, {"lang": "es", "value": "Net::IMAP implementa la funcionalidad de cliente del Protocolo de Acceso a Mensajes de Internet (IMAP) en Ruby. Antes de 0.6.5 y 0.5.15, varios comandos de Net::IMAP aceptan un argumento de cadena sin procesar que solo se valida para prevenir la inyecci\u00f3n de CRLF y luego se env\u00eda textualmente. Si esta cadena se deriva de una entrada controlada por el usuario, un atacante puede forzar que el siguiente comando sea absorbido como una continuaci\u00f3n del primer comando. Esto har\u00e1 que el primer comando falle eventualmente, pero tambi\u00e9n evita que regrese hasta que se env\u00ede otro comando (desde otro hilo). Ese otro comando no regresar\u00e1 hasta que se cierre la conexi\u00f3n. Esta vulnerabilidad est\u00e1 corregida en 0.6.5 y 0.5.15."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security-advisories@github.com"}