Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
CVSS Details
- CVSS 4.0 Base Score: 5.8 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bigdecimalUpgrade rubyUpgrade rubygem-rakeUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-irbUpgrade rubygem-jsonUpgrade ruby-docUpgrade ruby-irbUpgrade rubygem-did_you_meanUpgrade rubygem-rbsUpgrade rubygem-abrtUpgrade rubygem-test-unitUpgrade rubygem-rssUpgrade rubygem-rexmlUpgrade rubygem-bundlerUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2Upgrade rubygem-raccUpgrade rubygem-xmlrpcUpgrade rubygem-mongo-docUpgrade rubygem-bsonUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade rubygem-rdocUpgrade rubygem-mongoUpgrade rubygem-psychUpgrade rubygem-abrt-docUpgrade rubygem-net-telnetUpgrade rubygem-typeprofUpgrade rubygem-minitestUpgrade ruby-default-gemsUpgrade rubygem-pg-docUpgrade ruby-libsUpgrade rubygem-power_assertUpgrade rubygems-develUpgrade rubygemsUpgrade rubygem-bson-docUpgrade rubygem-mysql2-docUpgrade rubygem-bundler-doc | Jul 2, 2026 | Jun 30, 2026 |
| Amazon_linux_2023 | — | Upgrade ruby4.0-debugsourceUpgrade ruby4.0-rubygem-bigdecimalUpgrade ruby4.0-rubygem-io-console-debuginfoUpgrade ruby4.0-rubygem-raccUpgrade ruby4.0-rubygem-rexmlUpgrade ruby4.0-default-gemsUpgrade ruby4.0-rubygem-jsonUpgrade ruby4.0Upgrade ruby4.0-docUpgrade ruby4.0-rubygem-rdocUpgrade ruby4.0-rubygem-bundlerUpgrade ruby4.0-rubygem-power_assertUpgrade ruby4.0-rubygem-bigdecimal-debuginfoUpgrade ruby4.0-rubygem-json-debuginfoUpgrade ruby4.0-rubygem-racc-debuginfoUpgrade ruby4.0-rubygem-psychUpgrade ruby4.0-rubygem-rakeUpgrade ruby4.0-libsUpgrade ruby4.0-rubygem-io-consoleUpgrade ruby4.0-rubygem-rssUpgrade ruby4.0-rubygem-test-unitUpgrade ruby4.0-rubygem-typeprofUpgrade ruby4.0-bundled-gems-debuginfoUpgrade ruby4.0-bundled-gemsUpgrade ruby4.0-debuginfoUpgrade ruby4.0-rubygem-irbUpgrade ruby4.0-develUpgrade ruby4.0-libs-debuginfoUpgrade ruby4.0-rubygem-minitestUpgrade ruby4.0-rubygems-develUpgrade ruby4.0-rubygemsUpgrade ruby4.0-rubygem-psych-debuginfoUpgrade ruby4.0-rubygem-rbsUpgrade ruby4.0-rubygem-rbs-debuginfo | Jun 9, 2026 | May 9, 2026 |
| Redhat_linux | — | Upgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade ruby4.0-develUpgrade rubygem-rexmlUpgrade rubygem-test-unitUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-xmlrpcUpgrade ruby-docUpgrade rubygem-bundlerUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygem-mysql2-docUpgrade rubygem-did_you_meanUpgrade rubygem-rbs-debuginfoUpgrade rubyUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-opensslUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-abrtUpgrade rubygem-mysql2-debuginfoUpgrade ruby-default-gemsUpgrade ruby4.0Upgrade ruby4.0-docUpgrade ruby-irbUpgrade rubygem-rbsUpgrade ruby-bundled-gemsUpgrade rubygem-raccUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mongo-docUpgrade ruby4.0-debuginfoUpgrade rubygem-rdocUpgrade rubygem-irbUpgrade rubygem-psych-debuginfoUpgrade rubygem-minitestUpgrade rubygem-bundler-docUpgrade rubygem-psychUpgrade rubygem-bsonUpgrade rubygem-pgUpgrade ruby-tcltkUpgrade rubygem-pg-docUpgrade rubygem-bigdecimalUpgrade rubygem-bson-debugsourceUpgrade rubygem-racc-debuginfoUpgrade rubygem-jsonUpgrade ruby4.0-rubygem-mysql2Upgrade ruby-debugsourceUpgrade rubygems-develUpgrade rubygem-mongoUpgrade rubygem-json-debuginfoUpgrade rubygemsUpgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade rubygem-power_assertUpgrade rubygem-bson-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade ruby-libsUpgrade rubygem-typeprofUpgrade ruby-libs-debuginfoUpgrade rubygem-rssUpgrade rubygem-mysql2-debugsourceUpgrade ruby4.0-rubygem-pgUpgrade ruby4.0-debugsourceUpgrade rubygem-net-telnetUpgrade rubygem-openssl-debuginfo | Jul 2, 2026 | May 9, 2026 |
| Rocky_linux | — | Upgrade rubygem-opensslUpgrade rubygem-bson-debugsourceUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby4.0-develUpgrade rubygem-bson-debuginfoUpgrade rubygem-raccUpgrade rubygem-mysql2-debuginfoUpgrade ruby4.0-rubygem-mysql2Upgrade rubygem-mysql2Upgrade rubygem-pg-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-debugsourceUpgrade rubygem-pgUpgrade rubygem-rbsUpgrade rubygem-io-console-debuginfoUpgrade ruby-develUpgrade ruby-libsUpgrade ruby4.0-debugsourceUpgrade rubygem-jsonUpgrade ruby4.0Upgrade ruby-bundled-gems-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-bsonUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubyUpgrade rubygem-bigdecimalUpgrade ruby4.0-rubygem-pgUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-psychUpgrade ruby4.0-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gems | Jul 3, 2026 | Jul 1, 2026 |
| Ubuntu | — | Upgrade libruby2.3 (Ubuntu Pro) | Jul 20, 2026 | Jul 16, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub