🛡️ CVE-2026-42258 — net-imap

🟡 CVSS 5.3 — Medium ✅ No Known Exploit CWE-77 NVD

5.3

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

net-imap vulnerable to command Injection via unvalidated Symbol inputs

Summary

Symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands.

Details

Symbol arguments represent IMAP "system flags", which are formatted as "atoms" (with no quoting) with a "\" prefix. Vulnerable versions of Net::IMAP sends the symbol name directly to the socket, with no validation.

Because the Symbol input is unvalidated, it could contain invalid flag characters, including SP and CRLF, which could be used to finish the current command and inject new commands.

Although IMAP flag arguments are only valid input for a few IMAP commands, most Net::IMAP commands use generic argument handling, and will allow Symbol (flag) inputs.

Note also that the list of valid symbol inputs should be restricted to an enumerated set of standard RFC defined flag types, which have each been given specific defined semantics. Any user-provided values outside of that list of standard "system flags" needs to use the IMAP keyword syntax, which are sent as atoms, i.e: string inputs. Under no circumstances should #to_sym ever be called on unvetted user-provided input: that will always be a bug in the calling code for the simple reason that user_input_atom is as \user_input_atom.

For forward compatibility with future IMAP extentions, Net::IMAP, does not restrict flag inputs to an enumerated list. That is the responsibility of the calling application code, which knows which flag semantics are valid for its context.

Impact

If a developer passes user-controlled input as a Symbol to most Net::IMAP commands, an attacker can append CRLF sequence followed by a new IMAP command (like DELETE mailbox).

Mitigation

Upgrade to a version of Net::IMAP that validates Symbols are valid as an IMAP flag.
User-provided input should never be able to control calling #to_sym on string arguments.

For example, do not unsafely serialize and deserialize command arguments (e.g. with YAML or Marshal) in a way that could create unvetted Symbol arguments.

For the few IMAP commands which do allow flag arguments, it may be appropriate to hard-code Symbol arguments or restrict them to an enumerated list which is valid for the calling application.

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is high, an attacker needs low-level privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity high, availability low.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack vector: Local — a local account, shell or session on the host is needed.
Attack complexity: High — the attacker first has to win a race, learn a secret or otherwise prepare the target.
Privileges required: Low — an ordinary user account is enough.
User interaction: None — nobody has to be tricked into anything.
Scope: Unchanged — the damage stays inside the vulnerable component.
Confidentiality impact: None.
Integrity impact: High — total loss, or loss the attacker controls.
Availability impact: Low — limited, and the attacker does not choose what is affected.

Weakness class

CVE-2026-42258 is classified as CWE-77: Command Injection. User input is placed into a command that the system interprets, allowing extra commands to be appended to the intended one.

Affected software

CVE-2026-42258 is recorded against 2 packages.

net-imap (fixed in 0.4.24)
net\ (from 0.6.0 up to 0.6.4)

Timeline and source

Published on 4 May 2026 and last revised on 22 July 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

Other advisories for this package

net-imap has other advisories on record. If you are patching this one, these are worth checking on the same host:

CVE-2026-47241 (2.0 Low, published 9 Jun 2026)
CVE-2026-47240 (published 9 Jun 2026)
CVE-2026-47242 (published 9 Jun 2026)
CVE-2026-42246 (8.0 High, published 4 May 2026)
CVE-2026-42256 (published 4 May 2026)
CVE-2026-42257 (published 4 May 2026)
CVE-2026-42245 (2.0 Low, published 4 May 2026)
CVE-2025-43857 (published 28 Apr 2025)

Same weakness in other software

These advisories are the same class of weakness (CWE-77: Command Injection) in other software:

CVE-2025-29296 (9.8 Critical, published 4 Aug 2026)
CVE-2024-58354 (9.9 Critical, published 23 Jul 2026)
CVE-2014-6633 (8.0 High, published 9 Jul 2026)
CVE-2024-29640 (8.0 High, published 7 Jul 2026)
CVE-2023-39523 (6.8 Medium, published 7 Jul 2026)
CVE-2025-4032 (2.0 Low, published 7 Jul 2026)
CVE-2022-42906 (8.0 High, published 7 Jul 2026)
CVE-2024-4078 (9.8 Critical, published 7 Jul 2026)

CVE-2026-42258 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

BellSoft — BELL-CVE-2026-42258 Debian — DEBIAN-CVE-2026-42258 Ubuntu — UBUNTU-CVE-2026-42258

Details

Severity Medium

CVSS Score 5.3

CVSS Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L

CWE CWE-77

Public Exploit ✅ No

Source NVD

Published 2026-05-04

Updated 2026-08-20

Modified 2026-07-22

Fix URL N/A

Affected Packages

Software	From version	Fixed in
net-imap	—	0.4.24
net\	0.6.0	0.6.4

References

WEB https://github.com/ruby/net-imap/security/advisories/GHSA-75xq-5h9v-w6px

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-42258

WEB https://github.com/ruby/net-imap/commit/aec06996eb87a7e1bbcef1f9f8926e8add2b8c71

WEB https://github.com/ruby/net-imap/commit/9db3e9d60bfb8f3735ea95015bf8a700f4af9cbb

WEB https://github.com/ruby/net-imap/commit/6bf02aef7e0b5931010c36e377f79a71636b306b

WEB https://access.redhat.com/errata/RHSA-2026:33462

WEB https://access.redhat.com/errata/RHSA-2026:37238

WEB https://access.redhat.com/errata/RHSA-2026:37397

WEB https://access.redhat.com/errata/RHSA-2026:38694

WEB https://access.redhat.com/errata/RHSA-2026:40380

WEB https://access.redhat.com/security/cve/CVE-2026-42258

WEB https://bugzilla.redhat.com/show_bug.cgi?id=2468498

PACKAGE https://github.com/ruby/net-imap

WEB https://github.com/ruby/net-imap/releases/tag/v0.4.24

WEB https://github.com/ruby/net-imap/releases/tag/v0.5.14

WEB https://github.com/ruby/net-imap/releases/tag/v0.6.4

WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/net-imap/CVE-2026-42258.yml

WEB https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42258.json

WEB https://access.redhat.com/errata/RHSA-2026:33512

WEB https://access.redhat.com/errata/RHSA-2026:33514

WEB https://access.redhat.com/errata/RHSA-2026:33515

WEB https://access.redhat.com/errata/RHSA-2026:33540

WEB https://access.redhat.com/errata/RHSA-2026:33565

WEB https://access.redhat.com/errata/RHSA-2026:33576

WEB https://access.redhat.com/errata/RHSA-2026:33577

WEB https://access.redhat.com/errata/RHSA-2026:33630

WEB https://access.redhat.com/errata/RHSA-2026:33721

WEB https://access.redhat.com/errata/RHSA-2026:34076

WEB https://access.redhat.com/errata/RHSA-2026:35447

WEB https://access.redhat.com/errata/RHSA-2026:35834

WEB https://access.redhat.com/errata/RHSA-2026:35866

WEB https://access.redhat.com/errata/RHSA-2026:35867

WEB https://access.redhat.com/errata/RHSA-2026:35895

WEB https://access.redhat.com/errata/RHSA-2026:36099

WEB https://access.redhat.com/errata/RHSA-2026:36978

🔗 NVD 🔗 Mitre

Similar Threats

Vulnerability Monitoring

Track new vulnerabilities in net-imap

CVE-2026-42258 is rated CVSS 5.3 Medium. BotEraser monitors your WordPress installation and notifies you when software you use appears in our vulnerability database.

Set Up Free Alerts →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

🛡️ CVE-2026-42258 — net-imap

Description

Summary

Details

Impact

Mitigation

How this vulnerability can be exploited

CVSS metrics in full

Weakness class

Affected software

Timeline and source

References

Other advisories for this package

Same weakness in other software

CVE-2026-42258 on other distributions

Track new vulnerabilities in net-imap

Browse related advisories

Company

Resources

Services

Trusted

Subscribe