Name: CVE-2026-42257: Improper Neutralization of CRLF Sequences
Creator: Rapid7
Published: 2026-05-09T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-42257, CWE-77, CWE-93, CVSS 9.8, EPSS 0.00044

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

CVSS Details

CVSS 4.0 Base Score: 5.8 (MEDIUM)
CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 9.8
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade rubygem-io-consoleUpgrade rubygem-typeprofUpgrade rubygemsUpgrade rubygem-minitestUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-abrt-docUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-psychUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade rubygem-rssUpgrade rubygem-irbUpgrade rubygem-rakeUpgrade ruby-bundled-gemsUpgrade rubygem-rbsUpgrade ruby-develUpgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-pg-docUpgrade ruby-default-gemsUpgrade rubygem-mysql2-docUpgrade ruby-docUpgrade rubygem-raccUpgrade rubygem-rexmlUpgrade rubygem-rdoc	Oct 11, 2026	Aug 5, 2026
Redhat_linux	—	Upgrade ruby-debugsourceUpgrade ruby4.0-docUpgrade ruby4.0-rubygem-mysql2Upgrade rubygem-rbs-debuginfoUpgrade ruby-docUpgrade rubygem-minitestUpgrade rubygem-bigdecimalUpgrade ruby-bundled-gemsUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-power_assertUpgrade ruby-develUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2Upgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rbsUpgrade rubygem-rakeUpgrade rubygem-raccUpgrade ruby-libsUpgrade ruby4.0Upgrade rubygem-typeprofUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-rexmlUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade ruby4.0-develUpgrade ruby-libs-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-rssUpgrade rubygem-bundlerUpgrade rubygem-mysql2-docUpgrade rubygem-irbUpgrade rubygem-racc-debuginfoUpgrade rubygems-develUpgrade rubygemsUpgrade rubygem-psychUpgrade ruby-default-gemsUpgrade rubygem-psych-debuginfoUpgrade ruby4.0-debuginfoUpgrade ruby4.0-rubygem-pgUpgrade rubygem-rdocUpgrade ruby4.0-debugsource	Jul 17, 2026	May 9, 2026
Rocky_linux	—	Upgrade ruby-bundled-gemsUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby4.0-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade rubygem-rbsUpgrade rubygem-pgUpgrade rubygem-mysql2-debuginfoUpgrade ruby4.0-rubygem-pgUpgrade ruby4.0-debugsourceUpgrade rubygem-pg-debugsourceUpgrade ruby-develUpgrade ruby4.0-develUpgrade rubygem-io-console-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubyUpgrade rubygem-mysql2Upgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-racc-debuginfoUpgrade ruby-libsUpgrade ruby4.0Upgrade rubygem-raccUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-consoleUpgrade ruby4.0-rubygem-mysql2Upgrade rubygem-json-debuginfoUpgrade rubygem-jsonUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade ruby-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-mysql2-debugsource	Aug 28, 2026	Aug 27, 2026
Ubuntu	—	Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.3Upgrade libruby3.0Upgrade libruby3.3Upgrade ruby3.2Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby3.0Upgrade ruby2.7 (Ubuntu Pro)	Jun 16, 2026	Jun 15, 2026

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business