Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
CVSS Details
- CVSS 4.0 Base Score: 5.8 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ruby-default-gemsUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygemsUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygem-bundler-docUpgrade rubygem-net-telnetUpgrade rubygem-psychUpgrade rubygem-pgUpgrade rubygem-mongoUpgrade rubygem-pg-docUpgrade rubygem-typeprofUpgrade rubygem-rdocUpgrade rubygem-abrt-docUpgrade rubygem-opensslUpgrade rubygem-bson-docUpgrade rubygem-test-unitUpgrade ruby-bundled-gemsUpgrade rubygem-rssUpgrade rubygem-bundlerUpgrade rubygem-rexmlUpgrade rubygem-io-consoleUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-mysql2Upgrade ruby-develUpgrade rubygem-rakeUpgrade rubygem-raccUpgrade ruby-docUpgrade rubygem-irbUpgrade rubygem-jsonUpgrade ruby-irbUpgrade rubygem-did_you_meanUpgrade rubygem-rbsUpgrade rubygem-mongo-docUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubygem-bson | Jul 2, 2026 | Jun 30, 2026 |
| Amazon_linux_2023 | — | Upgrade ruby4.0-rubygem-rbs-debuginfoUpgrade ruby4.0-develUpgrade ruby4.0-rubygems-develUpgrade ruby4.0-bundled-gems-debuginfoUpgrade ruby4.0-libs-debuginfoUpgrade ruby4.0-rubygem-irbUpgrade ruby4.0-rubygem-minitestUpgrade ruby4.0-rubygem-psych-debuginfoUpgrade ruby4.0-rubygem-rbsUpgrade ruby4.0-bundled-gemsUpgrade ruby4.0-rubygemsUpgrade ruby4.0-debuginfoUpgrade ruby4.0-rubygem-rakeUpgrade ruby4.0-rubygem-psychUpgrade ruby4.0-debugsourceUpgrade ruby4.0-rubygem-rexmlUpgrade ruby4.0-rubygem-jsonUpgrade ruby4.0-rubygem-rssUpgrade ruby4.0-rubygem-racc-debuginfoUpgrade ruby4.0-rubygem-typeprofUpgrade ruby4.0-libsUpgrade ruby4.0-rubygem-rdocUpgrade ruby4.0-docUpgrade ruby4.0-rubygem-io-consoleUpgrade ruby4.0-rubygem-test-unitUpgrade ruby4.0-rubygem-power_assertUpgrade ruby4.0Upgrade ruby4.0-rubygem-json-debuginfoUpgrade ruby4.0-rubygem-bundlerUpgrade ruby4.0-rubygem-bigdecimal-debuginfoUpgrade ruby4.0-default-gemsUpgrade ruby4.0-rubygem-bigdecimalUpgrade ruby4.0-rubygem-raccUpgrade ruby4.0-rubygem-io-console-debuginfo | Jun 9, 2026 | May 9, 2026 |
| Redhat_linux | — | Upgrade rubygem-abrt-docUpgrade ruby4.0-rubygem-mysql2Upgrade ruby4.0-debugsourceUpgrade rubygems-develUpgrade ruby-debugsourceUpgrade rubygem-jsonUpgrade rubygem-power_assertUpgrade ruby-libsUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-rssUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-mongoUpgrade ruby-tcltkUpgrade rubygem-net-telnetUpgrade rubygemsUpgrade rubygem-typeprofUpgrade rubygem-json-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-bson-docUpgrade rubygem-racc-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bsonUpgrade ruby-libs-debuginfoUpgrade rubygem-pgUpgrade rubygem-bson-debugsourceUpgrade ruby4.0-rubygem-pgUpgrade ruby-default-gemsUpgrade ruby4.0-docUpgrade ruby4.0-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-did_you_meanUpgrade ruby4.0Upgrade ruby-irbUpgrade rubyUpgrade rubygem-rbsUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-io-consoleUpgrade ruby-docUpgrade rubygem-test-unitUpgrade ruby4.0-develUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rdocUpgrade rubygem-pg-debugsourceUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-irbUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade ruby-debuginfoUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-opensslUpgrade rubygem-rakeUpgrade rubygem-mongo-docUpgrade rubygem-rexmlUpgrade rubygem-xmlrpcUpgrade rubygem-abrtUpgrade rubygem-racc | Jul 2, 2026 | May 9, 2026 |
| Rocky_linux | — | Upgrade ruby-debuginfoUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-jsonUpgrade ruby4.0-rubygem-pgUpgrade rubygem-racc-debuginfoUpgrade ruby-develUpgrade ruby4.0Upgrade ruby4.0-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2-debugsourceUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bigdecimalUpgrade rubyUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-json-debuginfoUpgrade ruby4.0-debugsourceUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade rubygem-rbsUpgrade ruby4.0-rubygem-mysql2Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-raccUpgrade rubygem-bson-debugsourceUpgrade rubygem-opensslUpgrade rubygem-bson-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade ruby4.0-develUpgrade rubygem-pgUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-pg-debugsource | Jul 3, 2026 | Jul 1, 2026 |
| Ubuntu | — | Upgrade libruby2.3 (Ubuntu Pro) | Jul 20, 2026 | Jul 16, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub