Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
CVSS Details
- CVSS 4.0 Base Score: 5.8 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade rubygem-json-debuginfoUpgrade ruby4.0-develUpgrade rubygem-rssUpgrade ruby-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-racc-debuginfoUpgrade rubygem-irbUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rdocUpgrade ruby4.0-debugsourceUpgrade ruby4.0-debuginfoUpgrade ruby4.0-rubygem-pgUpgrade rubygem-bundlerUpgrade rubygem-typeprofUpgrade rubygem-pgUpgrade rubygem-test-unitUpgrade ruby-bundled-gems-debuginfoUpgrade rubygemsUpgrade rubygems-develUpgrade rubygem-psych-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-psychUpgrade rubygem-rexmlUpgrade rubygem-abrt-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rbsUpgrade rubygem-rakeUpgrade rubygem-rbs-debuginfoUpgrade rubygem-pg-docUpgrade ruby-debugsourceUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade rubygem-jsonUpgrade ruby-develUpgrade ruby-docUpgrade rubyUpgrade rubygem-abrtUpgrade rubygem-raccUpgrade rubygem-mysql2-debugsourceUpgrade ruby4.0-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade ruby4.0-rubygem-mysql2Upgrade ruby4.0Upgrade ruby-bundled-gems | Jul 17, 2026 | May 9, 2026 |
| Rocky_linux | — | Upgrade ruby4.0-debugsourceUpgrade ruby4.0-debuginfoUpgrade rubygem-psychUpgrade ruby4.0-develUpgrade ruby-bundled-gemsUpgrade ruby4.0-rubygem-pgUpgrade ruby-develUpgrade rubygem-rbsUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pgUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade ruby-libs-debuginfoUpgrade ruby4.0Upgrade ruby4.0-rubygem-mysql2Upgrade ruby-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-json-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-jsonUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade ruby-libsUpgrade rubygem-raccUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade ruby4.0-rubygem-mysql2-debuginfo | Aug 28, 2026 | Aug 27, 2026 |
| Ubuntu | — | Upgrade ruby3.0Upgrade ruby3.3Upgrade libruby3.0Upgrade libruby3.3Upgrade ruby3.2Upgrade ruby2.7 (Ubuntu Pro)Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.2 | Jun 16, 2026 | Jun 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub