Critical severity · published May 9, 2026
CVE-2026-42257
net-imap: Command Injection via "raw" arguments to multiple commands
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
net-imap · ruby
< 0.4.24; >= 0.5.0, < 0.5.14; >= 0.6.0, < 0.6.4 · source: vendor
NE
Net::imap · Ruby-lang
before 0.4.24; 0.5.0 before 0.5.14; 0.6.0 before 0.6.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42257
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42257
Release Notes
https://github.com/ruby/net-imap/releases/tag/v0.4.24
Release Notes
https://github.com/ruby/net-imap/releases/tag/v0.5.14
Release Notes
https://github.com/ruby/net-imap/releases/tag/v0.6.4
Mitigation
https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg
More from net-imap
7.5
CVE-2026-42245
net-imap: Quadratic complexity when reading response literals
7.4
CVE-2026-42246
net-imap vulnerable to STARTTLS stripping via invalid response timing
6.5
CVE-2026-42256
net-imap: Denial of service via high iteration count for `SCRAM-*` authentication
5.8
CVE-2026-47242
Net::IMAP: Command Injection via ID command argument
5.8
CVE-2026-47240
Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument