Every CVE Search/ Get API key

CVE-2026-42257

net-imap: Command Injection via "raw" arguments to multiple commands

5.8 MediumFix available

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
Low

Exploit likelihood

0.43%Up 0.4 points since May 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.8

net-imap: Command Injection via "raw" arguments to multiple commands

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Record
CVE-2026-42257
CVSS 4.0
5.8 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-93, CWE-77
Updated
2026-11-02
EUVDEUVD-2026-28926 5.8

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Record
EUVD-2026-28926
CVSS 4.0
5.8 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-hm49-wcqc-g2xg 5.8

net-imap vulnerable to command Injection via "raw" arguments to multiple commands

Summary

Several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands.

Details

Net::IMAP's generic argument handling, used by most command arguments, interprets string arguments as an IMAP astring. Depending on the string contents and the connection's UTF-8 support, this encodes strings as either a atom, quoted, or literal. These are safe from command or argument injection.

But the following commands transform specific String arguments to Net::IMAP::RawData, which bypasses normal argument validation and encoding and prints the string directly to the socket:

  • #uid_search, #search, #uid_sort, #sort, #uid_thread, #thread
    • when criteria is a String, it is sent raw
  • #uid_fetch, `#fetch
    • when attr is a String, it is sent raw
    • when attr is an Array, each String in attr is sent raw
  • #uid_store, #store
    • when attr is a String, it is sent raw
  • #setquota:
    • limit is interpolated with #to_s and that string is sent raw

Because these string arguments are sent without any neutralization, they serve as a direct vector for command splitting. Any user controlled data interpolated into these strings can be used to break out of the intended command context.

Using "raw data" arguments for #uid_store, #store, and #setquota I both inappropriate and unnecessary. Net::IMAP's generic argument handling is sufficient to safely validate and encode their arguments. Users of the library probably do not expect arguments to these commands to be sent raw and might not be wary of passing unvalidated input.

The API for search criteria and fetch attributes is intentionally low-level and "close to the wire". It allows developers to use some IMAP extensions without requiring explicit support from the library and allows developers to use complex IMAP grammar without complex argument translation. Even so, basic validation is appropriate and could neutralize command injection.

Although this was explicitly documented for search criteria, it was insufficiently documented for fetch attr. So developers may not have realized that the attr argument to #fetch and #uid_fetch is sent as "raw data".

Impact

If a developer passes an unvalidated user-controlled input for one of these method arguments, an attacker can append CRLF sequence followed by a new IMAP command (like DELETE mailbox). Although this does not directly enable data exfiltration, it could be combined with other attack vectors or knowledge of the target system's attributes, e.g.: shared mail folders or the application's installed response handlers.

The SEARCH, STORE, and FETCH commands, and their UID variants are some of the most commonly used features of the library. Applications that build search queries or fetch attributes dynamically based on user input (e.g., mail clients or archival tools) may be at significant risk.

The SORT and THREAD commands and their UID variants also handle their search criteria argument similarly to SEARCH and are subject to the same risk.

Expected use of Net::IMAP#setquota is much more limited: SETQUOTA is often only usable by users with special administrative privileges. Depending on the server, quota administration might be managed through server configuration rather than via the IMAP protocol SETQUOTA command. It is expected to be uncommonly used in system administration scripts or in interactive sessions, it should be completely controlled by trusted users, and should only use trusted inputs. Calling #setquota with untrusted user input is expected to be a very uncommon use case. Please note however this might be combined with other attacks, for example CSRF, which provide unauthorized access to trusted inputs, and may specifically target…

Record
GHSA-hm49-wcqc-g2xg
CVSS 4.0
5.8 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-77, CWE-93
Updated
2026-11-02
NVD 5.8

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Record
CVE-2026-42257
CVSS 4.0
5.8 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77, CWE-93
Updated
2026-11-02
OSVALPINE-CVE-2026-42257 9.8

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Record
ALPINE-CVE-2026-42257
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2026-42257 9.8
Record
BELL-CVE-2026-42257
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 26 moreShow less
OSV 5.8

net-imap: Command Injection via "raw" arguments to multiple commands

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Record
CVE-2026-42257
CVSS 4.0
5.8 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-77, CWE-93
Updated
2026-11-02
OSVDEBIAN-CVE-2026-42257 9.8

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Record
DEBIAN-CVE-2026-42257
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-07
OSVGHSA-hm49-wcqc-g2xg 5.8

net-imap vulnerable to command Injection via "raw" arguments to multiple commands

Summary

Several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands.

Details

Net::IMAP's generic argument handling, used by most command arguments, interprets string arguments as an IMAP astring. Depending on the string contents and the connection's UTF-8 support, this encodes strings as either a atom, quoted, or literal. These are safe from command or argument injection.

But the following commands transform specific String arguments to Net::IMAP::RawData, which bypasses normal argument validation and encoding and prints the string directly to the socket:

  • #uid_search, #search, #uid_sort, #sort, #uid_thread, #thread
    • when criteria is a String, it is sent raw
  • #uid_fetch, `#fetch
    • when attr is a String, it is sent raw
    • when attr is an Array, each String in attr is sent raw
  • #uid_store, #store
    • when attr is a String, it is sent raw
  • #setquota:
    • limit is interpolated with #to_s and that string is sent raw

Because these string arguments are sent without any neutralization, they serve as a direct vector for command splitting. Any user controlled data interpolated into these strings can be used to break out of the intended command context.

Using "raw data" arguments for #uid_store, #store, and #setquota I both inappropriate and unnecessary. Net::IMAP's generic argument handling is sufficient to safely validate and encode their arguments. Users of the library probably do not expect arguments to these commands to be sent raw and might not be wary of passing unvalidated input.

The API for search criteria and fetch attributes is intentionally low-level and "close to the wire". It allows developers to use some IMAP extensions without requiring explicit support from the library and allows developers to use complex IMAP grammar without complex argument translation. Even so, basic validation is appropriate and could neutralize command injection.

Although this was explicitly documented for search criteria, it was insufficiently documented for fetch attr. So developers may not have realized that the attr argument to #fetch and #uid_fetch is sent as "raw data".

Impact

If a developer passes an unvalidated user-controlled input for one of these method arguments, an attacker can append CRLF sequence followed by a new IMAP command (like DELETE mailbox). Although this does not directly enable data exfiltration, it could be combined with other attack vectors or knowledge of the target system's attributes, e.g.: shared mail folders or the application's installed response handlers.

The SEARCH, STORE, and FETCH commands, and their UID variants are some of the most commonly used features of the library. Applications that build search queries or fetch attributes dynamically based on user input (e.g., mail clients or archival tools) may be at significant risk.

The SORT and THREAD commands and their UID variants also handle their search criteria argument similarly to SEARCH and are subject to the same risk.

Expected use of Net::IMAP#setquota is much more limited: SETQUOTA is often only usable by users with special administrative privileges. Depending on the server, quota administration might be managed through server configuration rather than via the IMAP protocol SETQUOTA command. It is expected to be uncommonly used in system administration scripts or in interactive sessions, it should be completely controlled by trusted users, and should only use trusted inputs. Calling #setquota with untrusted user input is expected to be a very uncommon use case. Please note however this might be combined with other attacks, for example CSRF, which provide unauthorized access to trusted inputs, and may specifically target…

Record
GHSA-hm49-wcqc-g2xg
CVSS 4.0
5.8 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-77, CWE-93
Updated
2026-11-02
OSVOESA-2026-2578 9.8

ruby security update

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl).

Security Fix(es):

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.(CVE-2026-42245)

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.(CVE-2026-42246)

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.(CVE-2026-42257)

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.(CVE-2026-42258)

Record
OESA-2026-2578
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:35447 7.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:35447
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:36978 7.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:36978
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:38694 7.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:38694
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:40380 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:40380
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:50728 7.3

Red Hat Security Advisory: ruby:3.3 security, bug fix, and enhancement update

Record
RHSA-2026:50728
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:50773 7.3

Red Hat Security Advisory: ruby4.0 security, bug fix, and enhancement update

Record
RHSA-2026:50773
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:50778 7.3

Red Hat Security Advisory: ruby security, bug fix, and enhancement update

Record
RHSA-2026:50778
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:50827 7.3

Red Hat Security Advisory: ruby:4.0 security, bug fix, and enhancement update

Record
RHSA-2026:50827
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:50828 7.3

Red Hat Security Advisory: ruby:3.3 security, bug fix, and enhancement update

Record
RHSA-2026:50828
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:50728 7.3

Important: ruby:3.3 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)

  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)

  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-8] (JIRA:Rocky Linux-170929)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:50728
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:50773 7.3

Important: ruby4.0 security, bug fix, and enhancement update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)

  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)

  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby4.0: Rebase to the latest Ruby 4.0 release [rhel-10.2.z] (JIRA:Rocky Linux-211310)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:50773
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:50778 7.3

Important: ruby security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)

  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)

  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby: Rebase to the latest Ruby 3.3 release [rhel-10.2.z] (JIRA:Rocky Linux-211300)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:50778
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:50827 7.3

Important: ruby:4.0 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)

  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)

  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby:4.0/ruby: Rebase to the latest Ruby 4.0 release [rhel-9.8.z] (JIRA:Rocky Linux-211301)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:50827
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:50828 7.3

Important: ruby:3.3 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)

  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)

  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-9.8.z] (JIRA:Rocky Linux-171335)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:50828
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-42257 5.8

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Record
UBUNTU-CVE-2026-42257
CVSS 4.0
5.8 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:50728 No score

Important: ruby:3.3 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)
  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)
  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)
  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [almalinux-8] (JIRA:AlmaLinux-170929)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:50728
Updated
2026-11-02
OSVALSA-2026:50773 No score

Important: ruby4.0 security, bug fix, and enhancement update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)
  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)
  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)
  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby4.0: Rebase to the latest Ruby 4.0 release [almalinux-10.2.z] (JIRA:AlmaLinux-211310)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:50773
Updated
2026-11-02
OSVALSA-2026:50778 No score

Important: ruby security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)
  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)
  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)
  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby: Rebase to the latest Ruby 3.3 release [almalinux-10.2.z] (JIRA:AlmaLinux-211300)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:50778
Updated
2026-11-02
OSVALSA-2026:50827 No score

Important: ruby:4.0 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)
  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)
  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)
  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby:4.0/ruby: Rebase to the latest Ruby 4.0 release [almalinux-9.8.z] (JIRA:AlmaLinux-211301)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:50827
Updated
2026-11-02
OSVALSA-2026:50828 No score

Important: ruby:3.3 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)
  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)
  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)
  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [almalinux-9.8.z] (JIRA:AlmaLinux-171335)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:50828
Updated
2026-11-02
OSVCLSA-2026-1791199760 No score

ruby: Fix of 3 CVEs

  • CVE-2026-42257: fix Net::IMAP command injection through CRLF in raw search, sort, thread and fetch arguments
  • CVE-2026-47241: reject RawData ending in a zero-length literal prefix
  • CVE-2026-47240: reject non-synchronizing literals in RawData
Record
CLSA-2026-1791199760
Updated
2026-11-02
OSVCLSA-2026-1791456473 No score

ruby: Fix of CVE-2026-42257

  • CVE-2026-42257: net-imap: fix CRLF/command injection by validating RawData text and embedded literals, sending the STORE attr as an atom, sending the setquota storage limit as a number, and refusing LITERAL+ writes to servers not known to support them
Record
CLSA-2026-1791456473
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
net-imap
RubyGems
 0.6.0 to 0.6.3
0.6.4
net-imap
RubyGems
 0.5.0 to 0.5.13
0.5.14
net-imap
RubyGems
 through 0.4.23
0.4.24
ruby-net-imap
Alpine:v3.21
 before 0.4.25-r0
0.4.25-r0
ruby
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el8.10.0+4241+4264e34b
3.3.12-8.module_el8.10.0+4241+4264e34b
ruby-bundled-gems
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el8.10.0+4241+4264e34b
3.3.12-8.module_el8.10.0+4241+4264e34b
ruby-default-gems
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el8.10.0+4241+4264e34b
3.3.12-8.module_el8.10.0+4241+4264e34b
ruby-devel
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el8.10.0+4241+4264e34b
3.3.12-8.module_el8.10.0+4241+4264e34b
ruby-doc
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el8.10.0+4241+4264e34b
3.3.12-8.module_el8.10.0+4241+4264e34b
ruby-libs
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el8.10.0+4241+4264e34b
3.3.12-8.module_el8.10.0+4241+4264e34b
Show 290 moreShow less
Affected packages
PackageAffectedFixed
rubygem-abrt
AlmaLinux:8
From an advisory covering 6 CVEs
 before 0.4.0-1.module_el8.10.0+3799+191214cc
0.4.0-1.module_el8.10.0+3799+191214cc
rubygem-abrt-doc
AlmaLinux:8
From an advisory covering 6 CVEs
 before 0.4.0-1.module_el8.10.0+3799+191214cc
0.4.0-1.module_el8.10.0+3799+191214cc
rubygem-bigdecimal
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.1.5-8.module_el8.10.0+4241+4264e34b
3.1.5-8.module_el8.10.0+4241+4264e34b
rubygem-bundler
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2.5.22-8.module_el8.10.0+4241+4264e34b
2.5.22-8.module_el8.10.0+4241+4264e34b
rubygem-io-console
AlmaLinux:8
From an advisory covering 6 CVEs
 before 0.7.1-8.module_el8.10.0+4241+4264e34b
0.7.1-8.module_el8.10.0+4241+4264e34b
rubygem-irb
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1.13.1-8.module_el8.10.0+4241+4264e34b
1.13.1-8.module_el8.10.0+4241+4264e34b
rubygem-json
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2.7.2-8.module_el8.10.0+4241+4264e34b
2.7.2-8.module_el8.10.0+4241+4264e34b
rubygem-minitest
AlmaLinux:8
From an advisory covering 6 CVEs
 before 5.20.0-8.module_el8.10.0+4241+4264e34b
5.20.0-8.module_el8.10.0+4241+4264e34b
rubygem-mysql2
AlmaLinux:8
From an advisory covering 6 CVEs
 before 0.5.5-1.module_el8.10.0+3799+191214cc
0.5.5-1.module_el8.10.0+3799+191214cc
rubygem-mysql2-doc
AlmaLinux:8
From an advisory covering 6 CVEs
 before 0.5.5-1.module_el8.10.0+3799+191214cc
0.5.5-1.module_el8.10.0+3799+191214cc
rubygem-pg
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1.5.4-1.module_el8.10.0+3799+191214cc
1.5.4-1.module_el8.10.0+3799+191214cc
rubygem-pg-doc
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1.5.4-1.module_el8.10.0+3799+191214cc
1.5.4-1.module_el8.10.0+3799+191214cc
rubygem-power_assert
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2.0.3-8.module_el8.10.0+4241+4264e34b
2.0.3-8.module_el8.10.0+4241+4264e34b
rubygem-psych
AlmaLinux:8
From an advisory covering 6 CVEs
 before 5.1.2-8.module_el8.10.0+4241+4264e34b
5.1.2-8.module_el8.10.0+4241+4264e34b
rubygem-racc
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1.7.3-8.module_el8.10.0+4241+4264e34b
1.7.3-8.module_el8.10.0+4241+4264e34b
rubygem-rake
AlmaLinux:8
From an advisory covering 6 CVEs
 before 13.1.0-8.module_el8.10.0+4241+4264e34b
13.1.0-8.module_el8.10.0+4241+4264e34b
rubygem-rbs
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.4.0-8.module_el8.10.0+4241+4264e34b
3.4.0-8.module_el8.10.0+4241+4264e34b
rubygem-rdoc
AlmaLinux:8
From an advisory covering 6 CVEs
 before 6.6.3.1-8.module_el8.10.0+4241+4264e34b
6.6.3.1-8.module_el8.10.0+4241+4264e34b
rubygem-rexml
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.4.4-8.module_el8.10.0+4241+4264e34b
3.4.4-8.module_el8.10.0+4241+4264e34b
rubygem-rss
AlmaLinux:8
From an advisory covering 6 CVEs
 before 0.3.1-8.module_el8.10.0+4241+4264e34b
0.3.1-8.module_el8.10.0+4241+4264e34b
rubygem-test-unit
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.6.1-8.module_el8.10.0+4241+4264e34b
3.6.1-8.module_el8.10.0+4241+4264e34b
rubygem-typeprof
AlmaLinux:8
From an advisory covering 6 CVEs
 before 0.21.9-8.module_el8.10.0+4241+4264e34b
0.21.9-8.module_el8.10.0+4241+4264e34b
rubygems
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.5.22-8.module_el8.10.0+4241+4264e34b
3.5.22-8.module_el8.10.0+4241+4264e34b
rubygems-devel
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.5.22-8.module_el8.10.0+4241+4264e34b
3.5.22-8.module_el8.10.0+4241+4264e34b
ruby4.0
AlmaLinux:10
From an advisory covering 6 CVEs
 before 4.0.6-36.el10_2
4.0.6-36.el10_2
ruby4.0-devel
AlmaLinux:10
From an advisory covering 6 CVEs
 before 4.0.6-36.el10_2
4.0.6-36.el10_2
ruby4.0-doc
AlmaLinux:10
From an advisory covering 6 CVEs
 before 4.0.6-36.el10_2
4.0.6-36.el10_2
ruby4.0-rubygem-mysql2
AlmaLinux:10
From an advisory covering 6 CVEs
 before 0.5.7-36.el10_2
0.5.7-36.el10_2
ruby4.0-rubygem-pg
AlmaLinux:10
From an advisory covering 6 CVEs
 before 1.6.3-36.el10_2
1.6.3-36.el10_2
ruby
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.3.12-14.el10_2
3.3.12-14.el10_2
ruby-bundled-gems
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.3.12-14.el10_2
3.3.12-14.el10_2
ruby-default-gems
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.3.12-14.el10_2
3.3.12-14.el10_2
ruby-devel
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.3.12-14.el10_2
3.3.12-14.el10_2
ruby-doc
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.3.12-14.el10_2
3.3.12-14.el10_2
ruby-libs
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.3.12-14.el10_2
3.3.12-14.el10_2
rubygem-bigdecimal
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.1.5-14.el10_2
3.1.5-14.el10_2
rubygem-bundler
AlmaLinux:10
From an advisory covering 6 CVEs
 before 2.5.22-14.el10_2
2.5.22-14.el10_2
rubygem-io-console
AlmaLinux:10
From an advisory covering 6 CVEs
 before 0.7.1-14.el10_2
0.7.1-14.el10_2
rubygem-irb
AlmaLinux:10
From an advisory covering 6 CVEs
 before 1.13.1-14.el10_2
1.13.1-14.el10_2
rubygem-json
AlmaLinux:10
From an advisory covering 6 CVEs
 before 2.7.2-14.el10_2
2.7.2-14.el10_2
rubygem-minitest
AlmaLinux:10
From an advisory covering 6 CVEs
 before 5.20.0-14.el10_2
5.20.0-14.el10_2
rubygem-power_assert
AlmaLinux:10
From an advisory covering 6 CVEs
 before 2.0.3-14.el10_2
2.0.3-14.el10_2
rubygem-psych
AlmaLinux:10
From an advisory covering 6 CVEs
 before 5.1.2-14.el10_2
5.1.2-14.el10_2
rubygem-racc
AlmaLinux:10
From an advisory covering 6 CVEs
 before 1.7.3-14.el10_2
1.7.3-14.el10_2
rubygem-rake
AlmaLinux:10
From an advisory covering 6 CVEs
 before 13.1.0-14.el10_2
13.1.0-14.el10_2
rubygem-rbs
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.4.0-14.el10_2
3.4.0-14.el10_2
rubygem-rdoc
AlmaLinux:10
From an advisory covering 6 CVEs
 before 6.6.3.1-14.el10_2
6.6.3.1-14.el10_2
rubygem-rexml
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.4.4-14.el10_2
3.4.4-14.el10_2
rubygem-rss
AlmaLinux:10
From an advisory covering 6 CVEs
 before 0.3.1-14.el10_2
0.3.1-14.el10_2
rubygem-test-unit
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.6.1-14.el10_2
3.6.1-14.el10_2
rubygem-typeprof
AlmaLinux:10
From an advisory covering 6 CVEs
 before 0.21.9-14.el10_2
0.21.9-14.el10_2
rubygems
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.5.22-14.el10_2
3.5.22-14.el10_2
rubygems-devel
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.5.22-14.el10_2
3.5.22-14.el10_2
ruby
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.6-34.module_el9.8.0+289+5a070f48
4.0.6-34.module_el9.8.0+289+5a070f48
ruby-bundled-gems
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.6-34.module_el9.8.0+289+5a070f48
4.0.6-34.module_el9.8.0+289+5a070f48
ruby-default-gems
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.6-34.module_el9.8.0+289+5a070f48
4.0.6-34.module_el9.8.0+289+5a070f48
ruby-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.6-34.module_el9.8.0+289+5a070f48
4.0.6-34.module_el9.8.0+289+5a070f48
ruby-doc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.6-34.module_el9.8.0+289+5a070f48
4.0.6-34.module_el9.8.0+289+5a070f48
ruby-libs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.6-34.module_el9.8.0+289+5a070f48
4.0.6-34.module_el9.8.0+289+5a070f48
rubygem-bigdecimal
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.1-34.module_el9.8.0+289+5a070f48
4.0.1-34.module_el9.8.0+289+5a070f48
rubygem-bundler
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.16-34.module_el9.8.0+289+5a070f48
4.0.16-34.module_el9.8.0+289+5a070f48
rubygem-io-console
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.8.2-34.module_el9.8.0+289+5a070f48
0.8.2-34.module_el9.8.0+289+5a070f48
rubygem-irb
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1.16.0-34.module_el9.8.0+289+5a070f48
1.16.0-34.module_el9.8.0+289+5a070f48
rubygem-json
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2.18.0-34.module_el9.8.0+289+5a070f48
2.18.0-34.module_el9.8.0+289+5a070f48
rubygem-minitest
AlmaLinux:9
From an advisory covering 6 CVEs
 before 6.0.0-34.module_el9.8.0+289+5a070f48
6.0.0-34.module_el9.8.0+289+5a070f48
rubygem-mysql2
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.5.7-1.module_el9.8.0+232+50f6dd36
0.5.7-1.module_el9.8.0+232+50f6dd36
rubygem-mysql2-doc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.5.7-1.module_el9.8.0+232+50f6dd36
0.5.7-1.module_el9.8.0+232+50f6dd36
rubygem-pg
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1.6.3-1.module_el9.8.0+232+50f6dd36
1.6.3-1.module_el9.8.0+232+50f6dd36
rubygem-pg-doc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1.6.3-1.module_el9.8.0+232+50f6dd36
1.6.3-1.module_el9.8.0+232+50f6dd36
rubygem-power_assert
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.0.1-34.module_el9.8.0+289+5a070f48
3.0.1-34.module_el9.8.0+289+5a070f48
rubygem-psych
AlmaLinux:9
From an advisory covering 6 CVEs
 before 5.3.1-34.module_el9.8.0+289+5a070f48
5.3.1-34.module_el9.8.0+289+5a070f48
rubygem-racc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1.8.1-34.module_el9.8.0+289+5a070f48
1.8.1-34.module_el9.8.0+289+5a070f48
rubygem-rake
AlmaLinux:9
From an advisory covering 6 CVEs
 before 13.3.1-34.module_el9.8.0+289+5a070f48
13.3.1-34.module_el9.8.0+289+5a070f48
rubygem-rbs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.10.0-34.module_el9.8.0+289+5a070f48
3.10.0-34.module_el9.8.0+289+5a070f48
rubygem-rdoc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 7.0.4-34.module_el9.8.0+289+5a070f48
7.0.4-34.module_el9.8.0+289+5a070f48
rubygem-rexml
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.4.4-34.module_el9.8.0+289+5a070f48
3.4.4-34.module_el9.8.0+289+5a070f48
rubygem-rss
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.3.2-34.module_el9.8.0+289+5a070f48
0.3.2-34.module_el9.8.0+289+5a070f48
rubygem-test-unit
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.7.5-34.module_el9.8.0+289+5a070f48
3.7.5-34.module_el9.8.0+289+5a070f48
rubygem-typeprof
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.31.1-34.module_el9.8.0+289+5a070f48
0.31.1-34.module_el9.8.0+289+5a070f48
rubygems
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.16-34.module_el9.8.0+289+5a070f48
4.0.16-34.module_el9.8.0+289+5a070f48
rubygems-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.16-34.module_el9.8.0+289+5a070f48
4.0.16-34.module_el9.8.0+289+5a070f48
ruby
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el9.8.0+288+22f1c9f2
3.3.12-8.module_el9.8.0+288+22f1c9f2
ruby-bundled-gems
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el9.8.0+288+22f1c9f2
3.3.12-8.module_el9.8.0+288+22f1c9f2
ruby-default-gems
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el9.8.0+288+22f1c9f2
3.3.12-8.module_el9.8.0+288+22f1c9f2
ruby-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el9.8.0+288+22f1c9f2
3.3.12-8.module_el9.8.0+288+22f1c9f2
ruby-doc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el9.8.0+288+22f1c9f2
3.3.12-8.module_el9.8.0+288+22f1c9f2
ruby-libs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el9.8.0+288+22f1c9f2
3.3.12-8.module_el9.8.0+288+22f1c9f2
rubygem-bigdecimal
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.1.5-8.module_el9.8.0+288+22f1c9f2
3.1.5-8.module_el9.8.0+288+22f1c9f2
rubygem-bundler
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2.5.22-8.module_el9.8.0+288+22f1c9f2
2.5.22-8.module_el9.8.0+288+22f1c9f2
rubygem-io-console
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.7.1-8.module_el9.8.0+288+22f1c9f2
0.7.1-8.module_el9.8.0+288+22f1c9f2
rubygem-irb
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1.13.1-8.module_el9.8.0+288+22f1c9f2
1.13.1-8.module_el9.8.0+288+22f1c9f2
rubygem-json
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2.7.2-8.module_el9.8.0+288+22f1c9f2
2.7.2-8.module_el9.8.0+288+22f1c9f2
rubygem-minitest
AlmaLinux:9
From an advisory covering 6 CVEs
 before 5.20.0-8.module_el9.8.0+288+22f1c9f2
5.20.0-8.module_el9.8.0+288+22f1c9f2
rubygem-mysql2
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.5.5-3.module_el9.7.0+184+e2e36072
0.5.5-3.module_el9.7.0+184+e2e36072
rubygem-mysql2-doc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.5.5-3.module_el9.7.0+184+e2e36072
0.5.5-3.module_el9.7.0+184+e2e36072
rubygem-pg
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1.5.4-2.module_el9.7.0+245+447713a2
1.5.4-2.module_el9.7.0+245+447713a2
rubygem-pg-doc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1.5.4-2.module_el9.7.0+245+447713a2
1.5.4-2.module_el9.7.0+245+447713a2
ruby-net-imap
Alpaquita:25
 0.5.8-r0 up to 0.5.14-r0
0.5.14-r0
ruby-net-imap
Alpaquita:stream
 0.4.8-r0 up to 0.5.14-r0
0.5.14-r0
ruby
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 3.0.4-160.el9_2.tuxcare.els21
3.0.4-160.el9_2.tuxcare.els21
ruby-default-gems
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 3.0.4-160.el9_2.tuxcare.els21
3.0.4-160.el9_2.tuxcare.els21
ruby-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 3.0.4-160.el9_2.tuxcare.els21
3.0.4-160.el9_2.tuxcare.els21
ruby-doc
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 3.0.4-160.el9_2.tuxcare.els21
3.0.4-160.el9_2.tuxcare.els21
ruby-libs
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 3.0.4-160.el9_2.tuxcare.els21
3.0.4-160.el9_2.tuxcare.els21
rubygem-bigdecimal
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 3.0.0-160.el9_2.tuxcare.els21
3.0.0-160.el9_2.tuxcare.els21
rubygem-bundler
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 2.2.33-160.el9_2.tuxcare.els21
2.2.33-160.el9_2.tuxcare.els21
rubygem-io-console
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 0.5.7-160.el9_2.tuxcare.els21
0.5.7-160.el9_2.tuxcare.els21
rubygem-irb
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1.3.5-160.el9_2.tuxcare.els21
1.3.5-160.el9_2.tuxcare.els21
rubygem-json
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 2.5.1-160.el9_2.tuxcare.els21
2.5.1-160.el9_2.tuxcare.els21
rubygem-minitest
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 5.14.2-160.el9_2.tuxcare.els21
5.14.2-160.el9_2.tuxcare.els21
rubygem-power_assert
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1.2.0-160.el9_2.tuxcare.els21
1.2.0-160.el9_2.tuxcare.els21
rubygem-psych
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 3.3.2-160.el9_2.tuxcare.els21
3.3.2-160.el9_2.tuxcare.els21
rubygem-rake
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 13.0.3-160.el9_2.tuxcare.els21
13.0.3-160.el9_2.tuxcare.els21
rubygem-rbs
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1.4.0-160.el9_2.tuxcare.els21
1.4.0-160.el9_2.tuxcare.els21
rubygem-rdoc
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 6.3.3-160.el9_2.tuxcare.els21
6.3.3-160.el9_2.tuxcare.els21
rubygem-rexml
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 3.3.3-160.el9_2.tuxcare.els21
3.3.3-160.el9_2.tuxcare.els21
rubygem-rss
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 0.2.9-160.el9_2.tuxcare.els21
0.2.9-160.el9_2.tuxcare.els21
rubygem-test-unit
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 3.3.7-160.el9_2.tuxcare.els21
3.3.7-160.el9_2.tuxcare.els21
rubygem-typeprof
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 0.15.2-160.el9_2.tuxcare.els21
0.15.2-160.el9_2.tuxcare.els21
rubygems
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 3.2.33-160.el9_2.tuxcare.els21
3.2.33-160.el9_2.tuxcare.els21
rubygems-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 3.2.33-160.el9_2.tuxcare.els21
3.2.33-160.el9_2.tuxcare.els21
ruby
TuxCare:AlmaLinux:9.6
 before 3.0.7-165.el9_6.tuxcare.els9
3.0.7-165.el9_6.tuxcare.els9
ruby-default-gems
TuxCare:AlmaLinux:9.6
 before 3.0.7-165.el9_6.tuxcare.els9
3.0.7-165.el9_6.tuxcare.els9
ruby-devel
TuxCare:AlmaLinux:9.6
 before 3.0.7-165.el9_6.tuxcare.els9
3.0.7-165.el9_6.tuxcare.els9
ruby-doc
TuxCare:AlmaLinux:9.6
 before 3.0.7-165.el9_6.tuxcare.els9
3.0.7-165.el9_6.tuxcare.els9
ruby-libs
TuxCare:AlmaLinux:9.6
 before 3.0.7-165.el9_6.tuxcare.els9
3.0.7-165.el9_6.tuxcare.els9
rubygem-bigdecimal
TuxCare:AlmaLinux:9.6
 before 3.0.0-165.el9_6.tuxcare.els9
3.0.0-165.el9_6.tuxcare.els9
rubygem-bundler
TuxCare:AlmaLinux:9.6
 before 2.2.33-165.el9_6.tuxcare.els9
2.2.33-165.el9_6.tuxcare.els9
rubygem-io-console
TuxCare:AlmaLinux:9.6
 before 0.5.7-165.el9_6.tuxcare.els9
0.5.7-165.el9_6.tuxcare.els9
rubygem-irb
TuxCare:AlmaLinux:9.6
 before 1.3.5-165.el9_6.tuxcare.els9
1.3.5-165.el9_6.tuxcare.els9
rubygem-json
TuxCare:AlmaLinux:9.6
 before 2.5.1-165.el9_6.tuxcare.els9
2.5.1-165.el9_6.tuxcare.els9
rubygem-minitest
TuxCare:AlmaLinux:9.6
 before 5.14.2-165.el9_6.tuxcare.els9
5.14.2-165.el9_6.tuxcare.els9
rubygem-power_assert
TuxCare:AlmaLinux:9.6
 before 1.2.1-165.el9_6.tuxcare.els9
1.2.1-165.el9_6.tuxcare.els9
rubygem-psych
TuxCare:AlmaLinux:9.6
 before 3.3.2-165.el9_6.tuxcare.els9
3.3.2-165.el9_6.tuxcare.els9
rubygem-rake
TuxCare:AlmaLinux:9.6
 before 13.0.3-165.el9_6.tuxcare.els9
13.0.3-165.el9_6.tuxcare.els9
rubygem-rbs
TuxCare:AlmaLinux:9.6
 before 1.4.0-165.el9_6.tuxcare.els9
1.4.0-165.el9_6.tuxcare.els9
rubygem-rdoc
TuxCare:AlmaLinux:9.6
 before 6.3.4.1-165.el9_6.tuxcare.els9
6.3.4.1-165.el9_6.tuxcare.els9
rubygem-rexml
TuxCare:AlmaLinux:9.6
 before 3.2.5-165.el9_6.tuxcare.els9
3.2.5-165.el9_6.tuxcare.els9
rubygem-rss
TuxCare:AlmaLinux:9.6
 before 0.2.9-165.el9_6.tuxcare.els9
0.2.9-165.el9_6.tuxcare.els9
rubygem-test-unit
TuxCare:AlmaLinux:9.6
 before 3.3.7-165.el9_6.tuxcare.els9
3.3.7-165.el9_6.tuxcare.els9
rubygem-typeprof
TuxCare:AlmaLinux:9.6
 before 0.15.2-165.el9_6.tuxcare.els9
0.15.2-165.el9_6.tuxcare.els9
rubygems
TuxCare:AlmaLinux:9.6
 before 3.2.33-165.el9_6.tuxcare.els9
3.2.33-165.el9_6.tuxcare.els9
rubygems-devel
TuxCare:AlmaLinux:9.6
 before 3.2.33-165.el9_6.tuxcare.els9
3.2.33-165.el9_6.tuxcare.els9
ruby3.1
Debian:12
 All versions, plus listed versions
3.1.2-73.1.2-7+deb12u13.1.2-7+hurd.13.1.2-83.1.2-8.1~exp13.1.2-8.33.1.2-8.43.1.2-8.5
 None known
ruby3.3
Debian:13
 before 3.3.13-0+deb13u1, plus listed versions
3.3.8-23.3.8-2.13.3.8-2.2
3.3.13-0+deb13u1
ruby3.3
Debian:14
 All versions, plus listed versions
3.3.8-23.3.8-2.13.3.8-2.2
 None known
net-imap
RubyGems
 0.6.0 up to 0.6.4, plus listed versions
0.6.10.6.20.6.3
0.6.4
net-imap
RubyGems
 0.5.0 up to 0.5.14, plus listed versions
0.5.10.5.100.5.110.5.120.5.13
Show 8 moreShow less
0.5.20.5.30.5.40.5.50.5.60.5.70.5.80.5.9
0.5.14
net-imap
RubyGems
 before 0.4.24, plus listed versions
0.1.00.1.10.2.00.2.10.2.2
Show 40 moreShow less
0.2.30.2.40.2.50.3.00.3.10.3.100.3.20.3.30.3.40.3.4.10.3.50.3.60.3.70.3.80.3.90.4.00.4.10.4.100.4.110.4.120.4.130.4.140.4.150.4.160.4.170.4.180.4.190.4.20.4.200.4.210.4.220.4.230.4.30.4.40.4.50.4.60.4.70.4.80.4.90.4.9.1
0.4.24
ruby
openEuler:20.03-LTS-SP4
From an advisory covering 4 CVEs
 before 2.5.8-138.oe2003sp4
2.5.8-138.oe2003sp4
ruby
openEuler:22.03-LTS-SP4
From an advisory covering 4 CVEs
 before 3.0.3-146.oe2203sp4
3.0.3-146.oe2203sp4
ruby
openEuler:24.03-LTS-SP1
From an advisory covering 4 CVEs
 before 3.2.2-154.oe2403sp1
3.2.2-154.oe2403sp1
ruby
openEuler:24.03-LTS-SP3
From an advisory covering 4 CVEs
 before 3.2.2-154.oe2403sp3
3.2.2-154.oe2403sp3
ruby4.0
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:4.0.5-35.hum1
0:4.0.5-35.hum1
ruby4.0-bundled-gems
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:4.0.5-35.hum1
0:4.0.5-35.hum1
ruby4.0-default-gems
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:4.0.5-35.hum1
0:4.0.5-35.hum1
ruby4.0-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:4.0.5-35.hum1
0:4.0.5-35.hum1
ruby4.0-doc
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:4.0.5-35.hum1
0:4.0.5-35.hum1
ruby4.0-libs
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:4.0.5-35.hum1
0:4.0.5-35.hum1
ruby3.4
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.4.10-31.hum1
0:3.4.10-31.hum1
ruby3.4-bundled-gems
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.4.10-31.hum1
0:3.4.10-31.hum1
ruby3.4-default-gems
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.4.10-31.hum1
0:3.4.10-31.hum1
ruby3.4-devel
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.4.10-31.hum1
0:3.4.10-31.hum1
ruby3.4-doc
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.4.10-31.hum1
0:3.4.10-31.hum1
ruby3.4-libs
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.4.10-31.hum1
0:3.4.10-31.hum1
rubygem3.4-bigdecimal
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.1.8-31.hum1
0:3.1.8-31.hum1
rubygem3.4-bundler
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:2.6.9-31.hum1
0:2.6.9-31.hum1
rubygem3.4-devel
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.6.9-31.hum1
0:3.6.9-31.hum1
rubygem3.4-io-console
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:0.8.1-31.hum1
0:0.8.1-31.hum1
rubygem3.4-irb
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.14.3-31.hum1
0:1.14.3-31.hum1
rubygem3.4-json
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:2.9.1-31.hum1
0:2.9.1-31.hum1
rubygem3.4-minitest
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:5.25.4-31.hum1
0:5.25.4-31.hum1
rubygem3.4-power_assert
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:2.0.5-31.hum1
0:2.0.5-31.hum1
rubygem3.4-psych
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:5.2.2-31.hum1
0:5.2.2-31.hum1
rubygem3.4-racc
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.8.1-31.hum1
0:1.8.1-31.hum1
rubygem3.4-rake
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:13.2.1-31.hum1
0:13.2.1-31.hum1
rubygem3.4-rbs
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.8.0-31.hum1
0:3.8.0-31.hum1
rubygem3.4-rdoc
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:6.14.0-31.hum1
0:6.14.0-31.hum1
rubygem3.4-rexml
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.4.4-31.hum1
0:3.4.4-31.hum1
rubygem3.4-rss
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:0.3.1-31.hum1
0:0.3.1-31.hum1
rubygem3.4-rubygems
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.6.9-31.hum1
0:3.6.9-31.hum1
rubygem3.4-test-unit
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.6.7-31.hum1
0:3.6.7-31.hum1
rubygem3.4-typeprof
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:0.30.1-31.hum1
0:0.30.1-31.hum1
ruby3.3
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:3.3.10-23.4.hum1
0:3.3.10-23.4.hum1
ruby3.3-bundled-gems
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:3.3.10-23.4.hum1
0:3.3.10-23.4.hum1
ruby3.3-default-gems
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:3.3.10-23.4.hum1
0:3.3.10-23.4.hum1
ruby3.3-devel
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:3.3.10-23.4.hum1
0:3.3.10-23.4.hum1
ruby3.3-doc
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:3.3.10-23.4.hum1
0:3.3.10-23.4.hum1
ruby3.3-libs
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:3.3.10-23.4.hum1
0:3.3.10-23.4.hum1
rubygem3.3-bigdecimal
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:3.1.5-23.4.hum1
0:3.1.5-23.4.hum1
rubygem3.3-bundler
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:2.5.22-23.4.hum1
0:2.5.22-23.4.hum1
rubygem3.3-devel
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:3.5.22-23.4.hum1
0:3.5.22-23.4.hum1
rubygem3.3-io-console
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:0.7.1-23.4.hum1
0:0.7.1-23.4.hum1
rubygem3.3-irb
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:1.13.1-23.4.hum1
0:1.13.1-23.4.hum1
rubygem3.3-json
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:2.7.2-23.4.hum1
0:2.7.2-23.4.hum1
rubygem3.3-minitest
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:5.20.0-23.4.hum1
0:5.20.0-23.4.hum1
rubygem3.3-power_assert
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:2.0.3-23.4.hum1
0:2.0.3-23.4.hum1
rubygem3.3-psych
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:5.1.2-23.4.hum1
0:5.1.2-23.4.hum1
rubygem3.3-racc
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:1.7.3-23.4.hum1
0:1.7.3-23.4.hum1
rubygem3.3-rake
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:13.1.0-23.4.hum1
0:13.1.0-23.4.hum1
rubygem3.3-rbs
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:3.4.0-23.4.hum1
0:3.4.0-23.4.hum1
rubygem3.3-rdoc
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:6.6.3.1-23.4.hum1
0:6.6.3.1-23.4.hum1
rubygem3.3-rexml
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:3.4.4-23.4.hum1
0:3.4.4-23.4.hum1
rubygem3.3-rss
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:0.3.1-23.4.hum1
0:0.3.1-23.4.hum1
rubygem3.3-rubygems
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:3.5.22-23.4.hum1
0:3.5.22-23.4.hum1
rubygem3.3-test-unit
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:3.6.1-23.4.hum1
0:3.6.1-23.4.hum1
rubygem3.3-typeprof
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:0.21.9-23.4.hum1
0:0.21.9-23.4.hum1
ruby
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-bundled-gems
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-bundled-gems-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-default-gems
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-doc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
rubygem-abrt
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.10.0+21226+b78a28c4
0:0.4.0-1.module+el8.10.0+21226+b78a28c4
rubygem-abrt-doc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.10.0+21226+b78a28c4
0:0.4.0-1.module+el8.10.0+21226+b78a28c4
rubygem-bigdecimal
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.1.5-8.module+el8.10.0+24567+c4e5368e
0:3.1.5-8.module+el8.10.0+24567+c4e5368e
rubygem-bigdecimal-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.1.5-8.module+el8.10.0+24567+c4e5368e
0:3.1.5-8.module+el8.10.0+24567+c4e5368e
rubygem-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2.5.22-8.module+el8.10.0+24567+c4e5368e
0:2.5.22-8.module+el8.10.0+24567+c4e5368e
rubygem-io-console
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.7.1-8.module+el8.10.0+24567+c4e5368e
0:0.7.1-8.module+el8.10.0+24567+c4e5368e
rubygem-io-console-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.7.1-8.module+el8.10.0+24567+c4e5368e
0:0.7.1-8.module+el8.10.0+24567+c4e5368e
rubygem-irb
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:1.13.1-8.module+el8.10.0+24567+c4e5368e
0:1.13.1-8.module+el8.10.0+24567+c4e5368e
rubygem-json
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2.7.2-8.module+el8.10.0+24567+c4e5368e
0:2.7.2-8.module+el8.10.0+24567+c4e5368e
rubygem-json-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2.7.2-8.module+el8.10.0+24567+c4e5368e
0:2.7.2-8.module+el8.10.0+24567+c4e5368e
rubygem-minitest
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:5.20.0-8.module+el8.10.0+24567+c4e5368e
0:5.20.0-8.module+el8.10.0+24567+c4e5368e
rubygem-mysql2
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.5.5-1.module+el8.10.0+21226+b78a28c4
0:0.5.5-1.module+el8.10.0+21226+b78a28c4
rubygem-mysql2-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.5.5-1.module+el8.10.0+21226+b78a28c4
0:0.5.5-1.module+el8.10.0+21226+b78a28c4
rubygem-mysql2-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.5.5-1.module+el8.10.0+21226+b78a28c4
0:0.5.5-1.module+el8.10.0+21226+b78a28c4
rubygem-mysql2-doc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.5.5-1.module+el8.10.0+21226+b78a28c4
0:0.5.5-1.module+el8.10.0+21226+b78a28c4
rubygem-pg
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:1.5.4-1.module+el8.10.0+21226+b78a28c4
0:1.5.4-1.module+el8.10.0+21226+b78a28c4
rubygem-pg-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:1.5.4-1.module+el8.10.0+21226+b78a28c4
0:1.5.4-1.module+el8.10.0+21226+b78a28c4
rubygem-pg-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:1.5.4-1.module+el8.10.0+21226+b78a28c4
0:1.5.4-1.module+el8.10.0+21226+b78a28c4
rubygem-pg-doc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:1.5.4-1.module+el8.10.0+21226+b78a28c4
0:1.5.4-1.module+el8.10.0+21226+b78a28c4
rubygem-power_assert
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2.0.3-8.module+el8.10.0+24567+c4e5368e
0:2.0.3-8.module+el8.10.0+24567+c4e5368e
rubygem-psych
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:5.1.2-8.module+el8.10.0+24567+c4e5368e
0:5.1.2-8.module+el8.10.0+24567+c4e5368e
rubygem-psych-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:5.1.2-8.module+el8.10.0+24567+c4e5368e
0:5.1.2-8.module+el8.10.0+24567+c4e5368e
rubygem-racc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:1.7.3-8.module+el8.10.0+24567+c4e5368e
0:1.7.3-8.module+el8.10.0+24567+c4e5368e
rubygem-racc-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:1.7.3-8.module+el8.10.0+24567+c4e5368e
0:1.7.3-8.module+el8.10.0+24567+c4e5368e
rubygem-rake
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:13.1.0-8.module+el8.10.0+24567+c4e5368e
0:13.1.0-8.module+el8.10.0+24567+c4e5368e
rubygem-rbs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.4.0-8.module+el8.10.0+24567+c4e5368e
0:3.4.0-8.module+el8.10.0+24567+c4e5368e
rubygem-rbs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.4.0-8.module+el8.10.0+24567+c4e5368e
0:3.4.0-8.module+el8.10.0+24567+c4e5368e
rubygem-rdoc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:6.6.3.1-8.module+el8.10.0+24567+c4e5368e
0:6.6.3.1-8.module+el8.10.0+24567+c4e5368e
rubygem-rexml
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.4.4-8.module+el8.10.0+24567+c4e5368e
0:3.4.4-8.module+el8.10.0+24567+c4e5368e
rubygem-rss
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.3.1-8.module+el8.10.0+24567+c4e5368e
0:0.3.1-8.module+el8.10.0+24567+c4e5368e
rubygem-test-unit
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.6.1-8.module+el8.10.0+24567+c4e5368e
0:3.6.1-8.module+el8.10.0+24567+c4e5368e
rubygem-typeprof
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.21.9-8.module+el8.10.0+24567+c4e5368e
0:0.21.9-8.module+el8.10.0+24567+c4e5368e
rubygems
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.5.22-8.module+el8.10.0+24567+c4e5368e
0:3.5.22-8.module+el8.10.0+24567+c4e5368e
rubygems-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.5.22-8.module+el8.10.0+24567+c4e5368e
0:3.5.22-8.module+el8.10.0+24567+c4e5368e
ruby4.0
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:4.0.6-36.el10_2
0:4.0.6-36.el10_2
ruby4.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:4.0.6-36.el10_2
0:4.0.6-36.el10_2
ruby4.0-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:4.0.6-36.el10_2
0:4.0.6-36.el10_2
ruby4.0-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:4.0.6-36.el10_2
0:4.0.6-36.el10_2
ruby
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+40269+dc93e2d1
0:3.3.12-8.module+el8.10.0+40269+dc93e2d1
rubygem-abrt
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.10.0+1679+61871737
0:0.4.0-1.module+el8.10.0+1679+61871737
rubygem-abrt
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.10.0+1741+bdb5b6ca
0:0.4.0-1.module+el8.10.0+1741+bdb5b6ca
rubygem-abrt
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.5.0+668+665814fa
0:0.4.0-1.module+el8.5.0+668+665814fa
rubygem-abrt
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.9.0+1537+0b2034bd
0:0.4.0-1.module+el8.9.0+1537+0b2034bd
rubygem-abrt
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.10.0+1827+16ecb9d2
0:0.4.0-1.module+el8.10.0+1827+16ecb9d2
rubygem-abrt
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.10.0+1820+f3fffb92
0:0.4.0-1.module+el8.10.0+1820+f3fffb92
rubygem-abrt
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.10.0+1826+b62220b4
0:0.4.0-1.module+el8.10.0+1826+b62220b4
rubygem-mysql2
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.5.5-1.module+el8.10.0+1679+61871737
0:0.5.5-1.module+el8.10.0+1679+61871737
rubygem-mysql2
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.5.5-1.module+el8.10.0+1827+16ecb9d2
0:0.5.5-1.module+el8.10.0+1827+16ecb9d2
rubygem-pg
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:1.5.4-1.module+el8.10.0+1679+61871737
0:1.5.4-1.module+el8.10.0+1679+61871737
rubygem-pg
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:1.5.4-1.module+el8.10.0+1827+16ecb9d2
0:1.5.4-1.module+el8.10.0+1827+16ecb9d2
ruby4.0
Rocky Linux:10
From an advisory covering 6 CVEs
 before 0:4.0.6-36.el10_2
0:4.0.6-36.el10_2
ruby
Rocky Linux:10
From an advisory covering 6 CVEs
 before 0:3.3.12-14.el10_2
0:3.3.12-14.el10_2
ruby
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:4.0.6-34.module+el9.8.0+40271+b5850c84
0:4.0.6-34.module+el9.8.0+40271+b5850c84
rubygem-mysql2
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:0.5.7-1.module+el9.8.0+40094+ce01217c
0:0.5.7-1.module+el9.8.0+40094+ce01217c
rubygem-pg
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:1.6.3-1.module+el9.8.0+40094+ce01217c
0:1.6.3-1.module+el9.8.0+40094+ce01217c
ruby
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el9.8.0+40270+7a73441e
0:3.3.12-8.module+el9.8.0+40270+7a73441e
rubygem-mysql2
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:0.5.5-3.module+el9.7.0+40032+36e56d0d
0:0.5.5-3.module+el9.7.0+40032+36e56d0d
rubygem-pg
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:1.5.4-2.module+el9.7.0+40188+314ad260.0.1
0:1.5.4-2.module+el9.7.0+40188+314ad260.0.1
jruby
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.5.6-5ubuntu11.5.6-61.5.6-71.5.6-9+deb8u2build0.14.04.1~esm2
 None known
ruby2.3
Ubuntu:Pro:16.04:LTS
 before 2.3.1-2~ubuntu16.04.16+esm14, plus listed versions
2.3.0-12.3.0-22.3.0-4ubuntu22.3.0-4ubuntu32.3.0-5ubuntu1
Show 26 moreShow less
2.3.1-2~16.042.3.1-2~16.04.22.3.1-2~16.04.42.3.1-2~16.04.52.3.1-2~16.04.62.3.1-2~16.04.72.3.1-2~16.04.92.3.1-2~16.04.102.3.1-2~16.04.112.3.1-2~16.04.122.3.1-2~ubuntu16.04.132.3.1-2~ubuntu16.04.142.3.1-2~ubuntu16.04.152.3.1-2~ubuntu16.04.162.3.1-2~ubuntu16.04.16+esm12.3.1-2~ubuntu16.04.16+esm22.3.1-2~ubuntu16.04.16+esm32.3.1-2~ubuntu16.04.16+esm42.3.1-2~ubuntu16.04.16+esm52.3.1-2~ubuntu16.04.16+esm62.3.1-2~ubuntu16.04.16+esm72.3.1-2~ubuntu16.04.16+esm82.3.1-2~ubuntu16.04.16+esm92.3.1-2~ubuntu16.04.16+esm102.3.1-2~ubuntu16.04.16+esm112.3.1-2~ubuntu16.04.16+esm12
2.3.1-2~ubuntu16.04.16+esm14
jruby
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.7.21-2ubuntu41.7.22-1ubuntu1
 None known
ruby2.5
Ubuntu:Pro:18.04:LTS
 before 2.5.1-1ubuntu1.16+esm8, plus listed versions
2.5.0~preview1-1ubuntu22.5.0-4ubuntu12.5.0-4ubuntu42.5.0-5ubuntu12.5.0-6ubuntu1
Show 22 moreShow less
2.5.1-1ubuntu12.5.1-1ubuntu1.12.5.1-1ubuntu1.22.5.1-1ubuntu1.42.5.1-1ubuntu1.52.5.1-1ubuntu1.62.5.1-1ubuntu1.72.5.1-1ubuntu1.82.5.1-1ubuntu1.92.5.1-1ubuntu1.102.5.1-1ubuntu1.112.5.1-1ubuntu1.122.5.1-1ubuntu1.132.5.1-1ubuntu1.142.5.1-1ubuntu1.152.5.1-1ubuntu1.162.5.1-1ubuntu1.16+esm12.5.1-1ubuntu1.16+esm32.5.1-1ubuntu1.16+esm42.5.1-1ubuntu1.16+esm52.5.1-1ubuntu1.16+esm62.5.1-1ubuntu1.16+esm7
2.5.1-1ubuntu1.16+esm8
jruby
Ubuntu:18.04:LTS
 All versions, plus listed versions
9.1.13.0-19.1.17.0-1~18.04
 None known
ruby2.7
Ubuntu:Pro:20.04:LTS
 before 2.7.0-5ubuntu1.18+esm5, plus listed versions
2.7.0-12.7.0-22.7.0-32.7.0-42.7.0-4ubuntu1
Show 22 moreShow less
2.7.0-5ubuntu12.7.0-5ubuntu1.12.7.0-5ubuntu1.22.7.0-5ubuntu1.32.7.0-5ubuntu1.42.7.0-5ubuntu1.52.7.0-5ubuntu1.62.7.0-5ubuntu1.72.7.0-5ubuntu1.82.7.0-5ubuntu1.92.7.0-5ubuntu1.102.7.0-5ubuntu1.112.7.0-5ubuntu1.122.7.0-5ubuntu1.132.7.0-5ubuntu1.142.7.0-5ubuntu1.152.7.0-5ubuntu1.162.7.0-5ubuntu1.172.7.0-5ubuntu1.182.7.0-5ubuntu1.18+esm12.7.0-5ubuntu1.18+esm32.7.0-5ubuntu1.18+esm4
2.7.0-5ubuntu1.18+esm5
jruby
Ubuntu:20.04:LTS
 All versions, plus listed versions
9.1.17.0-39.1.17.0-3build59.1.17.0-3build6
 None known
ruby3.0
Ubuntu:22.04:LTS
 before 3.0.2-7ubuntu2.13, plus listed versions
3.0.2-5ubuntu13.0.2-73.0.2-7ubuntu23.0.2-7ubuntu2.13.0.2-7ubuntu2.2
Show 9 moreShow less
3.0.2-7ubuntu2.33.0.2-7ubuntu2.43.0.2-7ubuntu2.53.0.2-7ubuntu2.63.0.2-7ubuntu2.73.0.2-7ubuntu2.83.0.2-7ubuntu2.103.0.2-7ubuntu2.113.0.2-7ubuntu2.12
3.0.2-7ubuntu2.13
jruby
Ubuntu:24.04:LTS
 All versions, plus listed versions
9.3.9.0+ds-19.4.5.0+ds-19.4.5.0+ds-1ubuntu19.4.6.0+ds-1ubuntu3
 None known
ruby3.2
Ubuntu:24.04:LTS
 before 3.2.3-1ubuntu0.24.04.8, plus listed versions
3.2.3-13.2.3-1build23.2.3-1build33.2.3-1ubuntu0.24.04.13.2.3-1ubuntu0.24.04.33.2.3-1ubuntu0.24.04.53.2.3-1ubuntu0.24.04.63.2.3-1ubuntu0.24.04.7
3.2.3-1ubuntu0.24.04.8
jruby
Ubuntu:25.10
 All versions, plus listed versions
9.4.8.0+ds-2ubuntu19.4.8.0+ds-3ubuntu1
 None known
ruby3.3
Ubuntu:25.10
 All versions, plus listed versions
3.3.7-1ubuntu23.3.8-2ubuntu13.3.8-2ubuntu23.3.8-2ubuntu2.1
 None known
jruby
Ubuntu:26.10
 All versions, plus listed versions
9.4.8.0+ds-3ubuntu19.4.14.0+ds-1
 None known
jruby
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.4.8.0+ds-3ubuntu1
 None known
ruby3.3
Ubuntu:26.04:LTS
 before 3.3.8-2ubuntu3.1, plus listed versions
3.3.8-2ubuntu23.3.8-2ubuntu3
3.3.8-2ubuntu3.1

History

History
RecordedChangedSources
affectedOSV
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42257 is a medium vulnerability (CVSS 5.8) in Ruby Net-imap, published May 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in net-imap 0.6.4.

References

Show 108 moreShow less
This page doesn't list everything

Left out here: 135 package rows and the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open