CVE-2026-42257

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42257", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-26T11:53:27.704Z", "datePublished": "2026-05-09T19:39:48.398Z", "dateUpdated": "2026-05-13T19:33:13.948Z"}, "containers": {"cna": {"title": "net-imap: Command Injection via \"raw\" arguments to multiple commands", "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "lang": "en", "description": "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-77", "lang": "en", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg"}, {"name": "https://github.com/ruby/net-imap/releases/tag/v0.4.24", "tags": ["x_refsource_MISC"], "url": "https://github.com/ruby/net-imap/releases/tag/v0.4.24"}, {"name": "https://github.com/ruby/net-imap/releases/tag/v0.5.14", "tags": ["x_refsource_MISC"], "url": "https://github.com/ruby/net-imap/releases/tag/v0.5.14"}, {"name": "https://github.com/ruby/net-imap/releases/tag/v0.6.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/ruby/net-imap/releases/tag/v0.6.4"}], "affected": [{"vendor": "ruby", "product": "net-imap", "versions": [{"version": "< 0.4.24", "status": "affected"}, {"version": ">= 0.5.0, < 0.5.14", "status": "affected"}, {"version": ">= 0.6.0, < 0.6.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-09T19:39:48.398Z"}, "descriptions": [{"lang": "en", "value": "Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4."}], "source": {"advisory": "GHSA-hm49-wcqc-g2xg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-13T19:27:16.888782Z", "id": "CVE-2026-42257", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T19:33:13.948Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42257", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T19:27:16.888782Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T19:33:08.202Z"}}], "cna": {"title": "net-imap: Command Injection via \"raw\" arguments to multiple commands", "source": {"advisory": "GHSA-hm49-wcqc-g2xg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "ruby", "product": "net-imap", "versions": [{"status": "affected", "version": "< 0.4.24"}, {"status": "affected", "version": ">= 0.5.0, < 0.5.14"}, {"status": "affected", "version": ">= 0.6.0, < 0.6.4"}]}], "references": [{"url": "https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg", "name": "https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ruby/net-imap/releases/tag/v0.4.24", "name": "https://github.com/ruby/net-imap/releases/tag/v0.4.24", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ruby/net-imap/releases/tag/v0.5.14", "name": "https://github.com/ruby/net-imap/releases/tag/v0.5.14", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ruby/net-imap/releases/tag/v0.6.4", "name": "https://github.com/ruby/net-imap/releases/tag/v0.6.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-93", "description": "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-09T19:39:48.398Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42257", "state": "PUBLISHED", "dateUpdated": "2026-05-13T19:33:13.948Z", "dateReserved": "2026-04-26T11:53:27.704Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-09T19:39:48.398Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "net-imap", "vendor": "ruby", "versions": [{"status": "affected", "version": "< 0.4.24"}, {"status": "affected", "version": ">= 0.5.0, < 0.5.14"}, {"status": "affected", "version": ">= 0.6.0, < 0.6.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "05DB8FF3-7546-470A-BBB4-4DCAEAD83D6F", "versionEndExcluding": "0.4.24", "vulnerable": true}, {"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "2CCEB891-1D8F-4431-A79C-2A7560A84F4E", "versionEndExcluding": "0.5.14", "versionStartIncluding": "0.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "9A6D1995-BFA3-490F-967D-252CA7BE2264", "versionEndExcluding": "0.6.4", "versionStartIncluding": "0.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4."}, {"lang": "es", "value": "Net::IMAP implementa la funcionalidad de cliente del Protocolo de Acceso a Mensajes de Internet (IMAP) en Ruby. Antes de las versiones 0.4.24, 0.5.14 y 0.6.4, varios comandos de Net::IMAP aceptan un argumento de cadena sin procesar que se env\u00eda al servidor sin validaci\u00f3n ni escape. Si esta cadena se deriva de una entrada controlada por el usuario, puede contener secuencias CRLF, que un atacante puede usar para inyectar comandos IMAP arbitrarios. Este problema ha sido parcheado en las versiones 0.4.24, 0.5.14 y 0.6.4."}], "id": "CVE-2026-42257", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42257", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-13T19:27:16.888782Z", "version": "2.0.3"}}]}, "published": "2026-05-09T20:16:28.463", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/ruby/net-imap/releases/tag/v0.4.24"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/ruby/net-imap/releases/tag/v0.5.14"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/ruby/net-imap/releases/tag/v0.6.4"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-93"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input", "id": "2468494", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468494"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L", "status": "draft"}, "cwe": "CWE-93", "details": ["A flaw was found in Net::IMAP, a Ruby library for Internet Message Access Protocol (IMAP) client functionality. Several Net::IMAP commands accept raw string arguments that are sent to the server without proper validation or escaping. If an application uses user-controlled input for these arguments, a remote attacker could inject Carriage Return Line Feed (CRLF) sequences."], "name": "CVE-2026-42257", "package_state": [{"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Fix deferred", "package_name": "3scale-amp21/system", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Fix deferred", "package_name": "3scale-amp21/zync", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Fix deferred", "package_name": "3scale-amp22/system", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Out of support scope", "package_name": "3scale-amp22/zync", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Fix deferred", "package_name": "3scale-amp2/system-rhel7", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Fix deferred", "package_name": "3scale-amp2/system-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Fix deferred", "package_name": "3scale-amp2/system-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Fix deferred", "package_name": "3scale-amp2/zync-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Out of support scope", "package_name": "3scale-amp2/zync-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "ruby", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "ruby4.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "ruby:3.3/ruby", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "ruby:3.3/ruby", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "ruby:4.0/ruby", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Under investigation", "package_name": "ruby3.3", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Under investigation", "package_name": "ruby3.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Under investigation", "package_name": "ruby4.0", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-05-09T19:39:48Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-42257\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42257\nhttps://github.com/ruby/net-imap/releases/tag/v0.4.24\nhttps://github.com/ruby/net-imap/releases/tag/v0.5.14\nhttps://github.com/ruby/net-imap/releases/tag/v0.6.4\nhttps://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.4.24)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.5.0,0.5.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.6.0,0.6.4)"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "net-imap", "source": "cna", "vendor": "ruby"}, "product": "net::imap", "vendor": "ruby-lang"}], "created": "2026-05-09T21:30:42.096716+00:00", "updated": "2026-05-10T20:00:05.884556+00:00", "vendors": ["ruby-lang", "ruby-lang$PRODUCT$net::imap"]}