CVE-2026-42246

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42246", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-25T05:37:12.118Z", "datePublished": "2026-05-09T19:33:17.880Z", "dateUpdated": "2026-08-24T12:06:55.143Z"}, "containers": {"cna": {"title": "net-imap vulnerable to STARTTLS stripping via invalid response timing", "problemTypes": [{"descriptions": [{"cweId": "CWE-392", "lang": "en", "description": "CWE-392: Missing Report of Error Condition", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-393", "lang": "en", "description": "CWE-393: Return of Wrong Status Code", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-754", "lang": "en", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-636", "lang": "en", "description": "CWE-636: Not Failing Securely ('Failing Open')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-841", "lang": "en", "description": "CWE-841: Improper Enforcement of Behavioral Workflow", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp"}, {"name": "https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618", "tags": ["x_refsource_MISC"], "url": "https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618"}, {"name": "https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e", "tags": ["x_refsource_MISC"], "url": "https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e"}, {"name": "https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c", "tags": ["x_refsource_MISC"], "url": "https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c"}, {"name": "https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da", "tags": ["x_refsource_MISC"], "url": "https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da"}, {"name": "https://github.com/ruby/net-imap/releases/tag/v0.3.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/ruby/net-imap/releases/tag/v0.3.10"}, {"name": "https://github.com/ruby/net-imap/releases/tag/v0.4.24", "tags": ["x_refsource_MISC"], "url": "https://github.com/ruby/net-imap/releases/tag/v0.4.24"}, {"name": "https://github.com/ruby/net-imap/releases/tag/v0.5.14", "tags": ["x_refsource_MISC"], "url": "https://github.com/ruby/net-imap/releases/tag/v0.5.14"}], "affected": [{"vendor": "ruby", "product": "net-imap", "versions": [{"version": "< 0.3.10", "status": "affected"}, {"version": ">= 0.4.0, < 0.4.24", "status": "affected"}, {"version": ">= 0.5.0, < 0.5.14", "status": "affected"}, {"version": ">= 0.6.0, < 0.6.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-09T19:33:17.880Z"}, "descriptions": [{"lang": "en", "value": "Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return \"successfully\", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4."}], "source": {"advisory": "GHSA-vcgp-9326-pqcp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-12T02:29:05.120225Z", "id": "CVE-2026-42246", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T02:29:15.333Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "ruby4.0", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.0.3-35.el10_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.3.10-13.el10_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.3.10-11.el10_0.2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:7"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.0.648-39.el7_9.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "ruby:2.5", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260615131019.489197e6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "ruby:3.3", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260615131010.489197e6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.4"], "defaultStatus": "affected", "packageName": "ruby:2.5", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8040020260630124058.522a0ee4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus_long_life:8.4"], "defaultStatus": "affected", "packageName": "ruby:2.5", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8040020260630124058.522a0ee4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.6"], "defaultStatus": "affected", "packageName": "ruby:2.5", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260630123825.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus_long_life:8.6"], "defaultStatus": "affected", "packageName": "ruby:2.5", "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260630123825.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_tus:8.8"], "defaultStatus": "affected", "packageName": "ruby:2.5", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260625114827.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.8"], "defaultStatus": "affected", "packageName": "ruby:2.5", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260625114827.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.7-167.el9_8", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "ruby:3.3", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9080020260615131001.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "ruby:4.0", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9080020260619130154.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.2"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.4-161.el9_2.3", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.4"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.7-162.el9_4.3", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.4"], "defaultStatus": "affected", "packageName": "ruby:3.3", "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9040020260630065449.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.7-165.el9_6.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "ruby:3.3", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9060020260630075016.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "ruby4-0-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.0.0-33.4.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "ruby3-4-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "3.4.10-31.hum1", "versionType": "rpm"}, {"lessThan": "*", "status": "unaffected", "version": "3.4.8-31.2.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "ruby3-3-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "3.3.10-23.2.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp21/system", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp21/zync", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp22/system", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp22/zync", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp2/system-rhel7", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp2/system-rhel8", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp2/system-rhel9", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp2/zync-rhel8", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp2/zync-rhel9", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:6"], "defaultStatus": "unknown", "packageName": "ruby", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "unaffected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}], "datePublic": "2026-05-09T19:33:17.880Z", "descriptions": [{"lang": "en", "value": "A flaw was found in the Ruby net-imap library. When upgrading a cleartext IMAP connection to TLS using the Net::IMAP#starttls method, the library improperly handles certain responses received during STARTTLS negotiation. A man-in-the-middle (MITM) attacker can inject a predicted tagged OK response before the client completes the STARTTLS command, causing the operation to appear successful without establishing a TLS session. As a result, the connection may continue to transmit sensitive information in cleartext and enable modification of data exchanged over the affected connection, while the application incorrectly believes that encryption has been enabled."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-325", "description": "Missing Cryptographic Step", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-42246"}, {"name": "RHBZ#2468499", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468499"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42246.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:37397"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:35895"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:33565"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:33540"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:33514"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:33515"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:35866"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:35867"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:34076"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:35834"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:33630"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:36099"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:33462"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:37238"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:33512"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:33576"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:33577"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:33721"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:33552"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:33551"}], "solutions": [{"lang": "en", "value": "RHSA-2026:37397: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"}, {"lang": "en", "value": "RHSA-2026:35895: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"}, {"lang": "en", "value": "RHSA-2026:33565: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}, {"lang": "en", "value": "RHSA-2026:33540: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}, {"lang": "en", "value": "RHSA-2026:33514: Red Hat Enterprise Linux AppStream (v. 8)"}, {"lang": "en", "value": "RHSA-2026:33515: Red Hat Enterprise Linux AppStream (v. 8)"}, {"lang": "en", "value": "RHSA-2026:35866: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"}, {"lang": "en", "value": "RHSA-2026:35867: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)"}, {"lang": "en", "value": "RHSA-2026:34076: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"}, {"lang": "en", "value": "RHSA-2026:35834: Red Hat Enterprise Linux AppStream E4S (v.9.2)"}, {"lang": "en", "value": "RHSA-2026:33630: Red Hat Enterprise Linux AppStream E4S (v.9.4)"}, {"lang": "en", "value": "RHSA-2026:36099: Red Hat Enterprise Linux AppStream E4S (v.9.4)"}, {"lang": "en", "value": "RHSA-2026:33462: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:37238: Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:33512: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"}, {"lang": "en", "value": "RHSA-2026:33576: Red Hat Enterprise Linux AppStream (v. 9)"}, {"lang": "en", "value": "RHSA-2026:33577: Red Hat Enterprise Linux AppStream (v. 9)"}, {"lang": "en", "value": "RHSA-2026:33721: Red Hat Hardened Images"}, {"lang": "en", "value": "RHSA-2026:33552: Red Hat Hardened Images"}, {"lang": "en", "value": "RHSA-2026:33551: Red Hat Hardened Images"}], "timeline": [{"lang": "en", "time": "2026-05-09T20:01:04.782Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-05-09T19:33:17.880Z", "value": "Made public."}], "title": "net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS", "workarounds": [{"lang": "en", "value": "As a temporary workaround, Users are strongly encouraged to switch from explicit TLS upgrading mechanisms (STARTTLS on port 143) to Implicit TLS connections (such as IMAPS on port 993).\n\nBy enforcing implicit TLS via port 993 from the initial socket creation step, the connection is mathematically protected against packet injection and connection degradation tactics entirely, bypassing the vulnerable implementation path."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-24T12:06:55.143Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:4.0.3-35.el10_2", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby4.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:3.3.10-13.el10_2", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:3.3.10-11.el10_0.2", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_els:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "versions": [{"status": "unaffected", "version": "0:2.0.0.648-39.el7_9.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "8100020260615131019.489197e6", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby:2.5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "8100020260615131010.489197e6", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby:3.3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.4"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "versions": [{"status": "unaffected", "version": "8040020260630124058.522a0ee4", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby:2.5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus_long_life:8.4"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "versions": [{"status": "unaffected", "version": "8040020260630124058.522a0ee4", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby:2.5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "versions": [{"status": "unaffected", "version": "8060020260630123825.ad008a3a", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby:2.5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus_long_life:8.6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On", "versions": [{"status": "unaffected", "version": "8060020260630123825.ad008a3a", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby:2.5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_tus:8.8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "versions": [{"status": "unaffected", "version": "8080020260625114827.63b34585", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby:2.5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:8.8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "8080020260625114827.63b34585", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby:2.5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:3.0.7-167.el9_8", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "9080020260615131001.9", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby:3.3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "9080020260619130154.9", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby:4.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.2"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:3.0.4-161.el9_2.3", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.4"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:3.0.7-162.el9_4.3", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.4"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "9040020260630065449.9", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby:3.3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:3.0.7-165.el9_6.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "versions": [{"status": "unaffected", "version": "9060020260630075016.9", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby:3.3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "4.0.0-33.4.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby4-0-main", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "3.4.10-31.hum1", "lessThan": "*", "versionType": "rpm"}, {"status": "unaffected", "version": "3.4.8-31.2.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby3-4-main", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "3.3.10-23.2.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby3-3-main", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "vendor": "Red Hat", "product": "Red Hat 3scale API Management Platform 2", "packageName": "3scale-amp21/system", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "vendor": "Red Hat", "product": "Red Hat 3scale API Management Platform 2", "packageName": "3scale-amp21/zync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "vendor": "Red Hat", "product": "Red Hat 3scale API Management Platform 2", "packageName": "3scale-amp22/system", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "vendor": "Red Hat", "product": "Red Hat 3scale API Management Platform 2", "packageName": "3scale-amp22/zync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "vendor": "Red Hat", "product": "Red Hat 3scale API Management Platform 2", "packageName": "3scale-amp2/system-rhel7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "vendor": "Red Hat", "product": "Red Hat 3scale API Management Platform 2", "packageName": "3scale-amp2/system-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "vendor": "Red Hat", "product": "Red Hat 3scale API Management Platform 2", "packageName": "3scale-amp2/system-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "vendor": "Red Hat", "product": "Red Hat 3scale API Management Platform 2", "packageName": "3scale-amp2/zync-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "vendor": "Red Hat", "product": "Red Hat 3scale API Management Platform 2", "packageName": "3scale-amp2/zync-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-05-09T20:01:04.782Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-05-09T19:33:17.880Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:37397: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"}, {"lang": "en", "value": "RHSA-2026:35895: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"}, {"lang": "en", "value": "RHSA-2026:33565: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}, {"lang": "en", "value": "RHSA-2026:33540: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}, {"lang": "en", "value": "RHSA-2026:33514: Red Hat Enterprise Linux AppStream (v. 8)"}, {"lang": "en", "value": "RHSA-2026:33515: Red Hat Enterprise Linux AppStream (v. 8)"}, {"lang": "en", "value": "RHSA-2026:35866: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"}, {"lang": "en", "value": "RHSA-2026:35867: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)"}, {"lang": "en", "value": "RHSA-2026:34076: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"}, {"lang": "en", "value": "RHSA-2026:35834: Red Hat Enterprise Linux AppStream E4S (v.9.2)"}, {"lang": "en", "value": "RHSA-2026:33630: Red Hat Enterprise Linux AppStream E4S (v.9.4)"}, {"lang": "en", "value": "RHSA-2026:36099: Red Hat Enterprise Linux AppStream E4S (v.9.4)"}, {"lang": "en", "value": "RHSA-2026:33462: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:37238: Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:33512: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"}, {"lang": "en", "value": "RHSA-2026:33576: Red Hat Enterprise Linux AppStream (v. 9)"}, {"lang": "en", "value": "RHSA-2026:33577: Red Hat Enterprise Linux AppStream (v. 9)"}, {"lang": "en", "value": "RHSA-2026:33721: Red Hat Hardened Images"}, {"lang": "en", "value": "RHSA-2026:33552: Red Hat Hardened Images"}, {"lang": "en", "value": "RHSA-2026:33551: Red Hat Hardened Images"}], "x_adpType": "supplier", "datePublic": "2026-05-09T19:33:17.880Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-42246", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468499", "name": "RHBZ#2468499", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42246.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:37397", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:35895", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:33565", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:33540", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:33514", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:33515", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:35866", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:35867", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:34076", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:35834", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:33630", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:36099", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:33462", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:37238", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:33512", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:33576", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:33577", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:33721", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:33552", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:33551", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "As a temporary workaround, Users are strongly encouraged to switch from explicit TLS upgrading mechanisms (STARTTLS on port 143) to Implicit TLS connections (such as IMAPS on port 993).\n\nBy enforcing implicit TLS via port 993 from the initial socket creation step, the connection is mathematically protected against packet injection and connection degradation tactics entirely, bypassing the vulnerable implementation path."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the Ruby net-imap library. When upgrading a cleartext IMAP connection to TLS using the Net::IMAP#starttls method, the library improperly handles certain responses received during STARTTLS negotiation. A man-in-the-middle (MITM) attacker can inject a predicted tagged OK response before the client completes the STARTTLS command, causing the operation to appear successful without establishing a TLS session. As a result, the connection may continue to transmit sensitive information in cleartext and enable modification of data exchanged over the affected connection, while the application incorrectly believes that encryption has been enabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-325", "description": "Missing Cryptographic Step"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-24T12:06:55.143Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42246", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-12T02:29:05.120225Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T02:29:10.449Z"}}], "cna": {"title": "net-imap vulnerable to STARTTLS stripping via invalid response timing", "source": {"advisory": "GHSA-vcgp-9326-pqcp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ruby", "product": "net-imap", "versions": [{"status": "affected", "version": "< 0.3.10"}, {"status": "affected", "version": ">= 0.4.0, < 0.4.24"}, {"status": "affected", "version": ">= 0.5.0, < 0.5.14"}, {"status": "affected", "version": ">= 0.6.0, < 0.6.4"}]}], "references": [{"url": "https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp", "name": "https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618", "name": "https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e", "name": "https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c", "name": "https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da", "name": "https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ruby/net-imap/releases/tag/v0.3.10", "name": "https://github.com/ruby/net-imap/releases/tag/v0.3.10", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ruby/net-imap/releases/tag/v0.4.24", "name": "https://github.com/ruby/net-imap/releases/tag/v0.4.24", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ruby/net-imap/releases/tag/v0.5.14", "name": "https://github.com/ruby/net-imap/releases/tag/v0.5.14", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return \"successfully\", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-392", "description": "CWE-392: Missing Report of Error Condition"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-393", "description": "CWE-393: Return of Wrong Status Code"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-754", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-636", "description": "CWE-636: Not Failing Securely ('Failing Open')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-841", "description": "CWE-841: Improper Enforcement of Behavioral Workflow"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-09T19:33:17.880Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42246", "state": "PUBLISHED", "dateUpdated": "2026-08-24T12:06:55.143Z", "dateReserved": "2026-04-25T05:37:12.118Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-09T19:33:17.880Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "net-imap", "vendor": "ruby", "versions": [{"status": "affected", "version": "< 0.3.10"}, {"status": "affected", "version": ">= 0.4.0, < 0.4.24"}, {"status": "affected", "version": ">= 0.5.0, < 0.5.14"}, {"status": "affected", "version": ">= 0.6.0, < 0.6.4"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "ruby4.0", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.0.3-35.el10_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.3.10-13.el10_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.3.10-11.el10_0.2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:7"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.0.648-39.el7_9.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "ruby:2.5", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260615131019.489197e6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "ruby:3.3", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260615131010.489197e6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.4"], "defaultStatus": "affected", "packageName": "ruby:2.5", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8040020260630124058.522a0ee4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus_long_life:8.4"], "defaultStatus": "affected", "packageName": "ruby:2.5", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8040020260630124058.522a0ee4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.6"], "defaultStatus": "affected", "packageName": "ruby:2.5", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260630123825.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus_long_life:8.6"], "defaultStatus": "affected", "packageName": "ruby:2.5", "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260630123825.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_tus:8.8"], "defaultStatus": "affected", "packageName": "ruby:2.5", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260625114827.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.8"], "defaultStatus": "affected", "packageName": "ruby:2.5", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260625114827.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.7-167.el9_8", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "ruby:3.3", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9080020260615131001.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "ruby:4.0", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9080020260619130154.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.2"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.4-161.el9_2.3", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.4"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.7-162.el9_4.3", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.4"], "defaultStatus": "affected", "packageName": "ruby:3.3", "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9040020260630065449.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.7-165.el9_6.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "ruby:3.3", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9060020260630075016.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "ruby4-0-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.0.0-33.4.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "ruby3-4-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "3.4.10-31.hum1", "versionType": "rpm"}, {"lessThan": "*", "status": "unaffected", "version": "3.4.8-31.2.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "ruby3-3-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "3.3.10-23.2.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp21/system", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp21/zync", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp22/system", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp22/zync", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp2/system-rhel7", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp2/system-rhel8", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp2/system-rhel9", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp2/zync-rhel8", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "unaffected", "packageName": "3scale-amp2/zync-rhel9", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:6"], "defaultStatus": "unknown", "packageName": "ruby", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "unaffected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "E2B6117A-DE77-4BB9-A73C-F20933514BAB", "versionEndExcluding": "0.3.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "79EE9345-B825-40F9-9CFF-9E9E1A3783DD", "versionEndExcluding": "0.4.24", "versionStartIncluding": "0.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "2CCEB891-1D8F-4431-A79C-2A7560A84F4E", "versionEndExcluding": "0.5.14", "versionStartIncluding": "0.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "9A6D1995-BFA3-490F-967D-252CA7BE2264", "versionEndExcluding": "0.6.4", "versionStartIncluding": "0.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return \"successfully\", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4."}, {"lang": "es", "value": "Net::IMAP implementa la funcionalidad de cliente del Protocolo de Acceso a Mensajes de Internet (IMAP) en Ruby. Antes de las versiones 0.3.10, 0.4.24, 0.5.14 y 0.6.4, un atacante man-in-the-middle puede hacer que Net::IMAP#starttls devuelva 'satisfactoriamente', sin iniciar TLS. Este problema ha sido parcheado en las versiones 0.3.10, 0.4.24, 0.5.14 y 0.6.4."}], "id": "CVE-2026-42246", "lastModified": "2026-08-24T13:18:41.420", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42246", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-12T02:29:05.120225Z", "version": "2.0.3"}}]}, "published": "2026-05-09T20:16:28.163", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/ruby/net-imap/releases/tag/v0.3.10"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/ruby/net-imap/releases/tag/v0.4.24"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/ruby/net-imap/releases/tag/v0.5.14"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:33462"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:33512"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:33514"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:33515"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:33540"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:33551"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:33552"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:33565"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:33576"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:33577"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:33630"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:33721"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:34076"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:35834"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:35866"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:35867"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:35895"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:36099"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:37238"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:37397"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-42246"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468499"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42246.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-392"}, {"lang": "en", "value": "CWE-393"}, {"lang": "en", "value": "CWE-636"}, {"lang": "en", "value": "CWE-754"}, {"lang": "en", "value": "CWE-841"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-325"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.3.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.4.0,0.4.24)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.5.0,0.5.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.6.0,0.6.4)"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "net-imap", "source": "cna", "vendor": "ruby"}, "product": "net::imap", "vendor": "ruby-lang"}], "created": "2026-05-09T21:30:42.097470+00:00", "updated": "2026-08-14T04:00:12.086560+00:00", "vendors": ["ruby-lang", "ruby-lang$PRODUCT$net::imap"]}