Name: CVE-2026-42246: Missing Report of Error Condition
Creator: Rapid7
Published: 2026-05-09T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-42246, CWE-636, CWE-754, CWE-393, CWE-325, CWE-392, CWE-841, CVSS 7.4, EPSS 0.00312

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.

CVSS Details

CVSS 4.0 Base Score: 7.6 (HIGH)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 7.4
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade rubygem-rexmlUpgrade ruby-bundled-gemsUpgrade rubygem-pgUpgrade rubygem-bsonUpgrade rubygem-rssUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade rubygem-mongoUpgrade rubygem-jsonUpgrade rubygem-xmlrpcUpgrade rubygem-bundler-docUpgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade rubygem-typeprofUpgrade rubygem-power_assertUpgrade ruby-libsUpgrade ruby-default-gemsUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygem-net-telnetUpgrade rubygemsUpgrade rubygem-opensslUpgrade rubygem-rdocUpgrade rubygem-rbsUpgrade rubygem-mongo-docUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-bigdecimalUpgrade rubygem-pg-docUpgrade rubygem-did_you_meanUpgrade ruby-irbUpgrade ruby-docUpgrade ruby-develUpgrade rubygem-raccUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade rubygem-irb	Jul 2, 2026	Jun 30, 2026
Amazon Linux Ami 2	—	Upgrade ruby-tcltkUpgrade rubygem-minitestUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygemsUpgrade rubygems-develUpgrade ruby-docUpgrade rubygem-rdocUpgrade ruby-debuginfoUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubyUpgrade ruby-irbUpgrade rubygem-rakeUpgrade rubygem-bigdecimal	Jul 8, 2026	Jul 8, 2026
Amazon_linux_2023	—	Upgrade ruby4.0-rubygem-json-debuginfoUpgrade ruby4.0Upgrade ruby4.0-rubygem-power_assertUpgrade ruby4.0-rubygemsUpgrade ruby4.0-rubygem-test-unitUpgrade ruby4.0-debuginfoUpgrade ruby4.0-rubygems-develUpgrade ruby4.0-rubygem-io-console-debuginfoUpgrade ruby4.0-rubygem-minitestUpgrade ruby4.0-rubygem-typeprofUpgrade ruby4.0-rubygem-bundlerUpgrade ruby4.0-rubygem-psychUpgrade ruby4.0-rubygem-rbs-debuginfoUpgrade ruby4.0-rubygem-psych-debuginfoUpgrade ruby4.0-default-gemsUpgrade ruby4.0-docUpgrade ruby4.0-bundled-gems-debuginfoUpgrade ruby4.0-debugsourceUpgrade ruby4.0-develUpgrade ruby4.0-rubygem-jsonUpgrade ruby4.0-rubygem-rexmlUpgrade ruby4.0-rubygem-racc-debuginfoUpgrade ruby4.0-bundled-gemsUpgrade ruby4.0-rubygem-bigdecimalUpgrade ruby4.0-rubygem-rssUpgrade ruby4.0-rubygem-bigdecimal-debuginfoUpgrade ruby4.0-rubygem-raccUpgrade ruby4.0-libsUpgrade ruby4.0-libs-debuginfoUpgrade ruby4.0-rubygem-io-consoleUpgrade ruby4.0-rubygem-rbsUpgrade ruby4.0-rubygem-rakeUpgrade ruby4.0-rubygem-rdocUpgrade ruby4.0-rubygem-irb	Jun 9, 2026	May 9, 2026
Redhat_linux	—	Upgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade ruby4.0Upgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-xmlrpcUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-develUpgrade rubygem-io-console-debuginfoUpgrade rubygem-raccUpgrade ruby-tcltkUpgrade rubygem-bson-debuginfoUpgrade rubygem-opensslUpgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-typeprofUpgrade rubygem-rakeUpgrade rubygem-bson-docUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade ruby4.0-develUpgrade ruby-default-gemsUpgrade ruby4.0-rubygem-mysql2Upgrade rubygem-pg-debuginfoUpgrade rubygem-irbUpgrade ruby4.0-docUpgrade rubygem-bundlerUpgrade rubygem-mongoUpgrade rubygem-io-consoleUpgrade rubygem-power_assertUpgrade ruby-irbUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-abrtUpgrade rubygem-did_you_meanUpgrade rubygem-net-telnetUpgrade rubygem-racc-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-rssUpgrade rubygem-psych-debuginfoUpgrade rubygemsUpgrade ruby-debugsourceUpgrade ruby-docUpgrade rubygem-rbs-debuginfoUpgrade rubygem-rexmlUpgrade rubygem-mysql2Upgrade rubyUpgrade ruby4.0-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade ruby-bundled-gemsUpgrade rubygem-psychUpgrade ruby-libsUpgrade ruby4.0-rubygem-pgUpgrade rubygem-rbsUpgrade rubygem-mongo-docUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade ruby4.0-debugsourceNo solution existsUpgrade rubygem-jsonUpgrade rubygem-bsonUpgrade rubygem-openssl-debuginfoUpgrade rubygem-abrt-doc	Jul 2, 2026	May 9, 2026
Rocky_linux	—	Upgrade rubygem-pg-debuginfoUpgrade ruby4.0Upgrade ruby4.0-rubygem-mysql2Upgrade rubygem-bson-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-racc-debuginfoUpgrade ruby-libsUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade ruby4.0-rubygem-pgUpgrade ruby-libs-debuginfoUpgrade rubygem-jsonUpgrade ruby4.0-develUpgrade rubyUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-opensslUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-raccUpgrade rubygem-pgUpgrade rubygem-pg-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby4.0-debugsourceUpgrade rubygem-mysql2Upgrade ruby-develUpgrade rubygem-bsonUpgrade ruby4.0-debuginfoUpgrade rubygem-rbsUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psychUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-openssl-debuginfo	Jul 3, 2026	Jul 1, 2026
Ubuntu	—	Upgrade ruby3.3Upgrade ruby3.0Upgrade libruby3.0Upgrade libruby2.7 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby3.2Upgrade ruby2.7 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.3	Jun 16, 2026	Jun 15, 2026

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business