Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.
CVSS Details
- CVSS 4.0 Base Score: 7.6 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-test-unitUpgrade ruby-bundled-gemsUpgrade rubygem-rdocUpgrade rubygem-net-telnetUpgrade rubygem-rssUpgrade rubygem-typeprofUpgrade rubygem-mongoUpgrade ruby-default-gemsUpgrade rubygem-opensslUpgrade rubygem-power_assertUpgrade ruby-libsUpgrade rubygem-abrt-docUpgrade rubygemsUpgrade rubygem-rbsUpgrade rubygem-rexmlUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade rubygem-xmlrpcUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubygem-bundler-docUpgrade rubygem-bsonUpgrade rubygem-jsonUpgrade rubygem-bson-docUpgrade ruby-docUpgrade rubygem-irbUpgrade rubygem-io-consoleUpgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade ruby-irbUpgrade rubygem-mongo-docUpgrade rubyUpgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade ruby-develUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade rubygem-raccUpgrade rubygems-develUpgrade rubygem-rake | Jul 2, 2026 | Jun 30, 2026 |
| Amazon Linux Ami 2 | — | Upgrade ruby-tcltkUpgrade rubygem-psychUpgrade rubygemsUpgrade rubygem-minitestUpgrade ruby-libsUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade rubyUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade ruby-irbUpgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade ruby-devel | Jul 8, 2026 | Jul 8, 2026 |
| Amazon_linux_2023 | — | Upgrade ruby4.0-rubygem-power_assertUpgrade ruby4.0-rubygem-io-console-debuginfoUpgrade ruby4.0-rubygem-test-unitUpgrade ruby4.0-debuginfoUpgrade ruby4.0-rubygem-typeprofUpgrade ruby4.0-debugsourceUpgrade ruby4.0-rubygemsUpgrade ruby4.0-rubygem-bundlerUpgrade ruby4.0-rubygem-json-debuginfoUpgrade ruby4.0Upgrade ruby4.0-rubygem-psychUpgrade ruby4.0-default-gemsUpgrade ruby4.0-bundled-gems-debuginfoUpgrade ruby4.0-rubygem-minitestUpgrade ruby4.0-develUpgrade ruby4.0-rubygems-develUpgrade ruby4.0-docUpgrade ruby4.0-rubygem-psych-debuginfoUpgrade ruby4.0-rubygem-rbs-debuginfoUpgrade ruby4.0-rubygem-bigdecimal-debuginfoUpgrade ruby4.0-rubygem-rakeUpgrade ruby4.0-rubygem-rbsUpgrade ruby4.0-rubygem-racc-debuginfoUpgrade ruby4.0-rubygem-rdocUpgrade ruby4.0-bundled-gemsUpgrade ruby4.0-rubygem-irbUpgrade ruby4.0-rubygem-bigdecimalUpgrade ruby4.0-rubygem-jsonUpgrade ruby4.0-rubygem-rssUpgrade ruby4.0-libs-debuginfoUpgrade ruby4.0-rubygem-rexmlUpgrade ruby4.0-libsUpgrade ruby4.0-rubygem-raccUpgrade ruby4.0-rubygem-io-console | Jun 9, 2026 | May 9, 2026 |
| Redhat_linux | — | Upgrade ruby4.0-rubygem-mysql2Upgrade ruby4.0-docUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-mongoUpgrade rubygem-typeprofUpgrade rubygem-pg-docUpgrade rubygem-rdocUpgrade rubygem-irbUpgrade ruby-tcltkUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-bundlerUpgrade ruby-default-gemsUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-consoleUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-minitestUpgrade rubygem-raccUpgrade rubygem-bson-docUpgrade ruby4.0Upgrade rubygems-develUpgrade rubygem-opensslUpgrade ruby4.0-develUpgrade ruby-develUpgrade ruby-irbUpgrade rubygem-io-console-debuginfoUpgrade rubygem-power_assertUpgrade ruby-docUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-pgUpgrade ruby-debugsourceUpgrade rubygem-rssUpgrade rubygem-abrt-docUpgrade rubygem-psych-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-rexmlUpgrade ruby4.0-debuginfoUpgrade rubygem-rbsUpgrade rubygem-psychUpgrade rubygemsUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-test-unitUpgrade rubygem-rbs-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-abrtNo solution existsUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bsonUpgrade ruby4.0-debugsourceUpgrade rubygem-jsonUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-did_you_meanUpgrade ruby-libsUpgrade ruby-bundled-gemsUpgrade rubyUpgrade rubygem-mongo-docUpgrade rubygem-bundler-docUpgrade ruby4.0-rubygem-pgUpgrade rubygem-pg-debugsource | Jul 2, 2026 | May 9, 2026 |
| Rocky_linux | — | Upgrade ruby-develUpgrade ruby4.0-develUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade ruby4.0-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-io-console-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-opensslUpgrade ruby-bundled-gemsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pgUpgrade rubygem-jsonUpgrade rubygem-raccUpgrade rubygem-rbsUpgrade ruby4.0-debuginfoUpgrade rubyUpgrade rubygem-bsonUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-racc-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-openssl-debuginfoUpgrade ruby4.0-rubygem-pgUpgrade rubygem-bson-debuginfoUpgrade ruby4.0-rubygem-mysql2Upgrade ruby4.0Upgrade rubygem-pg-debuginfo | Jul 3, 2026 | Jul 1, 2026 |
| Ubuntu | — | Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby2.7 (Ubuntu Pro)Upgrade libruby3.3Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.0Upgrade libruby3.2Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby3.0Upgrade ruby3.3Upgrade ruby3.2Upgrade ruby2.3 (Ubuntu Pro) | Jun 16, 2026 | Jun 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub