Name: CVE-2026-42256: Use of Blocking Code in Single-threaded, Non-blocking Context
Creator: Rapid7
Published: 2026-05-09T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-42256, CWE-1322, CWE-770, CVSS 6.5, EPSS 0.00519

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

CVSS Details

CVSS 4.0 Base Score: 6 (MEDIUM)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 6.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade ruby-bundled-gemsUpgrade rubygem-minitestUpgrade rubygem-psychUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygemsUpgrade rubygem-abrt-docUpgrade rubygem-rssUpgrade rubygem-typeprofUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade rubygem-mysql2Upgrade rubygem-rexmlUpgrade rubygem-rdocUpgrade rubygem-irbUpgrade rubygem-abrtUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade ruby-default-gemsUpgrade rubyUpgrade ruby-docUpgrade ruby-develUpgrade rubygem-raccUpgrade rubygem-test-unitUpgrade rubygem-rbsUpgrade rubygem-bundlerUpgrade rubygem-power_assert	Oct 11, 2026	Aug 5, 2026
Redhat_linux	—	Upgrade rubygem-bigdecimalUpgrade rubygem-power_assertUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygemsUpgrade rubygem-json-debuginfoUpgrade rubygem-rdocUpgrade rubygem-io-console-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-mysql2-docUpgrade ruby4.0-debugsourceUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade ruby4.0-rubygem-mysql2Upgrade rubygem-bigdecimal-debuginfoUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-typeprofUpgrade rubygem-rbs-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-rbsUpgrade ruby4.0-develUpgrade ruby4.0-docUpgrade ruby-develUpgrade ruby4.0Upgrade rubygem-psychUpgrade rubygem-pgUpgrade rubygem-pg-debugsourceUpgrade rubygem-jsonUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade ruby-libs-debuginfoUpgrade ruby-libsUpgrade rubygem-pg-debuginfoUpgrade ruby4.0-rubygem-pgUpgrade ruby-default-gemsUpgrade rubygem-rakeUpgrade rubygem-raccUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-irbUpgrade rubygem-rexmlUpgrade ruby4.0-debuginfoUpgrade ruby-docUpgrade rubygem-rssUpgrade rubyUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2	Jul 17, 2026	May 9, 2026
Rocky_linux	—	Upgrade ruby4.0-rubygem-mysql2Upgrade rubygem-bigdecimalUpgrade ruby-debugsourceUpgrade ruby-libsUpgrade ruby-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-rbs-debuginfoUpgrade ruby4.0-rubygem-pgUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade ruby4.0Upgrade ruby4.0-develUpgrade rubygem-jsonUpgrade rubygem-raccUpgrade ruby-bundled-gemsUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby4.0-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-rbsUpgrade rubyUpgrade ruby-develUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-pgUpgrade ruby4.0-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-pg-debuginfo	Aug 28, 2026	Aug 27, 2026
Ubuntu	—	Upgrade libruby3.0Upgrade ruby3.3Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby3.0Upgrade ruby3.2Upgrade libruby3.3Upgrade libruby3.2Upgrade ruby2.7 (Ubuntu Pro)	Jun 30, 2026	Jun 29, 2025

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence