Name: CVE-2026-42258: Improper Neutralization of Special Elements used in a Command
Creator: Rapid7
Published: 2026-05-09T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-42258, CWE-77, CWE-93, CVSS 5.8, EPSS 0.01253

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

CVSS Details

CVSS 4.0 Base Score: 5.8 (MEDIUM)
CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade rubygem-mysql2-docUpgrade rubygem-opensslUpgrade rubygem-net-telnetUpgrade rubygem-bundler-docUpgrade rubygem-mongoUpgrade rubygem-abrt-docUpgrade rubygem-typeprofUpgrade rubygemsUpgrade rubygem-bson-docUpgrade rubygems-develUpgrade ruby-default-gemsUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-pgUpgrade rubygem-pg-docUpgrade rubygem-rdocUpgrade rubygem-abrtUpgrade rubygem-did_you_meanUpgrade rubygem-xmlrpcUpgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade rubygem-rexmlUpgrade rubygem-rakeUpgrade rubyUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-irbUpgrade ruby-develUpgrade ruby-irbUpgrade rubygem-mongo-docUpgrade rubygem-test-unitUpgrade rubygem-raccUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade rubygem-rbsUpgrade rubygem-rss	Jul 2, 2026	Jun 30, 2026
Amazon_linux_2023	—	Upgrade ruby4.0-rubygem-psychUpgrade ruby4.0-rubygem-rakeUpgrade ruby4.0-rubygem-rssUpgrade ruby4.0-rubygem-racc-debuginfoUpgrade ruby4.0-default-gemsUpgrade ruby4.0-rubygem-rexmlUpgrade ruby4.0-debugsourceUpgrade ruby4.0-rubygem-bigdecimalUpgrade ruby4.0-rubygem-bigdecimal-debuginfoUpgrade ruby4.0-rubygem-io-console-debuginfoUpgrade ruby4.0-rubygem-raccUpgrade ruby4.0-rubygem-power_assertUpgrade ruby4.0-rubygem-rdocUpgrade ruby4.0-rubygem-json-debuginfoUpgrade ruby4.0-docUpgrade ruby4.0-rubygem-bundlerUpgrade ruby4.0Upgrade ruby4.0-rubygem-test-unitUpgrade ruby4.0-rubygem-jsonUpgrade ruby4.0-rubygem-typeprofUpgrade ruby4.0-rubygem-io-consoleUpgrade ruby4.0-libsUpgrade ruby4.0-rubygem-psych-debuginfoUpgrade ruby4.0-rubygem-rbsUpgrade ruby4.0-develUpgrade ruby4.0-debuginfoUpgrade ruby4.0-rubygem-rbs-debuginfoUpgrade ruby4.0-rubygemsUpgrade ruby4.0-rubygem-minitestUpgrade ruby4.0-rubygems-develUpgrade ruby4.0-bundled-gemsUpgrade ruby4.0-rubygem-irbUpgrade ruby4.0-bundled-gems-debuginfoUpgrade ruby4.0-libs-debuginfo	Jun 9, 2026	May 9, 2026
Redhat_linux	—	Upgrade rubygem-bundlerUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-mysql2-docUpgrade ruby-irbUpgrade rubygem-io-console-debuginfoUpgrade rubygem-irbUpgrade ruby-debuginfoUpgrade ruby-develUpgrade rubygem-mysql2-debuginfoUpgrade ruby4.0-debuginfoUpgrade rubygem-rdocUpgrade rubygem-raccUpgrade ruby4.0-docUpgrade rubygem-did_you_meanUpgrade ruby-docUpgrade rubygem-rbs-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade ruby4.0Upgrade ruby-bundled-gemsUpgrade rubygem-mongo-docUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-test-unitUpgrade ruby-default-gemsUpgrade rubygem-xmlrpcUpgrade rubygem-rakeUpgrade rubygem-pg-debuginfoUpgrade rubygem-abrtUpgrade rubygem-mysql2Upgrade ruby4.0-develUpgrade rubygem-opensslUpgrade rubygem-io-consoleUpgrade rubygem-rexmlUpgrade rubygem-rbsUpgrade ruby4.0-rubygem-pgUpgrade rubygemsUpgrade rubygem-rssUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-typeprofUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade ruby-tcltkUpgrade rubygem-json-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygem-mysql2-debugsourceUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade ruby-libsUpgrade rubygem-bson-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-psych-debuginfoUpgrade rubygem-psychUpgrade rubygem-pg-docUpgrade rubygem-bundler-docUpgrade rubygem-bigdecimalUpgrade rubygem-racc-debuginfoUpgrade ruby4.0-rubygem-mysql2Upgrade ruby4.0-debugsourceUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade rubygems-develUpgrade rubygem-bsonUpgrade rubygem-bson-debugsourceUpgrade rubygem-pgUpgrade rubygem-openssl-debuginfo	Jul 2, 2026	May 9, 2026
Rocky_linux	—	Upgrade rubygem-pg-debugsourceUpgrade ruby-debugsourceUpgrade rubygem-rbsUpgrade ruby-libs-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-opensslUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-debuginfoUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-pgUpgrade rubygem-raccUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby4.0-develUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2Upgrade ruby4.0-rubygem-mysql2Upgrade ruby4.0-rubygem-pgUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubyUpgrade ruby-libsUpgrade rubygem-racc-debuginfoUpgrade rubygem-jsonUpgrade ruby4.0Upgrade ruby-develUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby4.0-debuginfoUpgrade rubygem-bsonUpgrade rubygem-io-consoleUpgrade rubygem-rbs-debuginfoUpgrade ruby4.0-debugsourceUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade ruby-bundled-gems	Jul 3, 2026	Jul 1, 2026
Ubuntu	—	Upgrade libruby2.3 (Ubuntu Pro)	Jul 20, 2026	Jul 16, 2026

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence