Approved changes feed: RSS · Atom
cpe:2.3:a:ruby-lang:net\:\:imap:*:*:*:*:*:ruby:*:*
part: a version: * update: *
| Vendor | Ruby Lang (5813a634-c286-5f1d-90d5-a1a352f78d39) |
|---|---|
| Product | Net::Imap (71c77504-a0b6-5d23-b6ca-58fa51d10995) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | ruby |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-42258 |
vulnerable | 2026-06-08 08:03:16.089240 |
net-imap: Command Injection via unvalidated Symbol inputs
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
Published: 2026-05-09T19:40:49.405Z
Updated: 2026-08-05T12:14:55.906Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42257 |
vulnerable | 2026-06-08 08:03:16.088922 |
net-imap: Command Injection via "raw" arguments to multiple commands
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
Published: 2026-05-09T19:39:48.398Z
Updated: 2026-05-13T19:33:13.948Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42256 |
vulnerable | 2026-06-08 08:03:16.088474 |
net-imap: Denial of service via high iteration count for `SCRAM-*` authentication
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
Published: 2026-05-09T19:38:33.106Z
Updated: 2026-05-11T17:04:42.562Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42246 |
vulnerable | 2026-06-08 08:03:16.074715 |
net-imap vulnerable to STARTTLS stripping via invalid response timing
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.
Published: 2026-05-09T19:33:17.880Z
Updated: 2026-08-05T12:14:46.068Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42245 |
vulnerable | 2026-06-08 08:03:16.074098 |
net-imap: Quadratic complexity when reading response literals
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
Published: 2026-05-09T19:37:08.905Z
Updated: 2026-05-12T18:30:58.415Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-43857 |
vulnerable | 2026-06-08 07:25:10.404653 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.