Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygems-develUpgrade rubygem-pgUpgrade rubygem-minitestUpgrade rubygem-abrt-docUpgrade rubygem-io-consoleUpgrade rubygem-power_assertUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-test-unitUpgrade rubygem-typeprofUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade ruby-default-gemsUpgrade rubyUpgrade rubygem-abrtUpgrade rubygem-pg-docUpgrade rubygem-irbUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade rubygem-mysql2Upgrade ruby-develUpgrade rubygem-raccUpgrade rubygem-bundlerUpgrade rubygem-rbsUpgrade rubygem-rssUpgrade rubygem-rexmlUpgrade rubygem-jsonUpgrade ruby-docUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2-doc | Oct 11, 2026 | Aug 5, 2026 |
| Redhat_linux | — | Upgrade rubygemsUpgrade ruby-debuginfoUpgrade ruby4.0-develUpgrade ruby4.0-debugsourceUpgrade ruby-libs-debuginfoUpgrade ruby4.0-debuginfoUpgrade ruby4.0-rubygem-pgUpgrade rubygem-rdocUpgrade rubygem-rssUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-pgUpgrade rubygem-json-debuginfoUpgrade rubygem-rexmlUpgrade rubygem-racc-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-typeprofUpgrade rubygem-io-console-debuginfoUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade rubygem-mysql2-docUpgrade rubygem-abrt-docUpgrade ruby-default-gemsUpgrade rubygems-develUpgrade rubygem-psychUpgrade rubygem-psych-debuginfoUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade ruby4.0Upgrade rubygem-rbsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-raccUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debugsourceUpgrade ruby-bundled-gemsUpgrade ruby4.0-rubygem-mysql2Upgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-power_assertUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubyUpgrade rubygem-abrtUpgrade ruby-docUpgrade ruby4.0-docUpgrade ruby-develUpgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygem-io-consoleUpgrade rubygem-pg-debuginfoUpgrade ruby4.0-rubygem-pg-debuginfo | Jul 17, 2026 | May 9, 2026 |
| Rocky_linux | — | Upgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade rubygem-pg-debuginfoUpgrade ruby4.0-rubygem-mysql2Upgrade rubygem-rbs-debuginfoUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-io-consoleUpgrade ruby4.0Upgrade rubygem-racc-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade rubygem-raccUpgrade ruby-debuginfoUpgrade ruby4.0-rubygem-pgUpgrade rubygem-rbsUpgrade ruby4.0-debugsourceUpgrade ruby4.0-develUpgrade rubygem-mysql2Upgrade rubygem-psych-debuginfoUpgrade ruby-develUpgrade ruby-bundled-gemsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pgUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-psychUpgrade rubyUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby4.0-debuginfo | Aug 28, 2026 | Aug 27, 2026 |
| Ubuntu | — | Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby3.3Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby3.3Upgrade ruby2.7 (Ubuntu Pro)Upgrade libruby3.0Upgrade ruby3.2Upgrade ruby3.0 | Jun 16, 2026 | Jun 15, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub