CVE-2026-42245
published 2026-05-09CVE-2026-42245: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.41%
32.7th percentile
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | system-rhel7 | — | — |
| 3scale-amp2 | system-rhel8 | — | — |
| 3scale-amp2 | system-rhel9 | — | — |
| 3scale-amp2 | zync-rhel8 | — | — |
| 3scale-amp2 | zync-rhel9 | — | — |
| 3scale-amp21 | system | — | — |
| 3scale-amp21 | zync | — | — |
| 3scale-amp22 | system | — | — |
| 3scale-amp22 | zync | — | — |
| debian | ruby3.3 | — | — |
| ruby-lang | net | < 0.4.24 | 0.4.24 |
| ruby-lang | net | >= 0.5.0 < 0.5.14 | 0.5.14 |
| ruby-lang | net | >= 0.6.0 < 0.6.4 | 0.6.4 |
| ruby-lang | ruby | — | — |
| ruby | net-imap | < 0.4.24 | 0.4.24 |
| ruby | net-imap | — | — |
| ruby | net-imap | — | — |
| ruby | net-imap | >= 0 < 0.4.24 | 0.4.24 |
| ruby | net-imap | >= 0.5.0 < 0.5.14 | 0.5.14 |
| ruby | net-imap | >= 0.6.0 < 0.6.4 | 0.6.4 |
| ruby_3.3 | ruby | — | — |
| ruby_4.0 | ruby | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.02.3LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat2.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses
vendor_redhat·2026-05-09·CVSS 2.3
CVE-2026-42245 [LOW] CWE-606 ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses
ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses
A flaw was found in Net::IMAP, a Ruby library implementing the Internet Message Access Protocol (IMAP) client functionality. A hostile server can exploit a quadratic time complexity issue in the `Net::IMAP::ResponseReader` when processing large responses containing numerous string literals. This can lead to the client's CPU being exhausted, resulting in a denial of service (DoS) attack.
Mitigation: To reduce the risk of a denial of service, ensure that applications using the Net::IMAP library are configured to connect exclusively to trusted IMAP servers. Avoid connecting to untrusted or unverified IMAP services, as a hostile server can exploit this vulnerability. This operational control helps prevent exposure to mal
VulDB
ruby net-imap up to 0.4.23/0.5.13/0.6.3 Net::IMAP algorithmic complexity (GHSA-q2mw-fvj9-vvcw)
vuldb·2026-05-18·CVSS 2.3
CVE-2026-42245 [LOW] ruby net-imap up to 0.4.23/0.5.13/0.6.3 Net::IMAP algorithmic complexity (GHSA-q2mw-fvj9-vvcw)
A vulnerability identified as problematic has been detected in ruby net-imap up to 0.4.23/0.5.13/0.6.3. This affects the function Net::IMAP. Performing a manipulation results in inefficient algorithmic complexity.
This vulnerability is cataloged as CVE-2026-42245. It is possible to initiate the attack remotely. There is no exploit available.
You should upgrade the affected component.
GHSA
net-imap has quadratic complexity when reading response literals
ghsa·2026-05-04
CVE-2026-42245 [LOW] CWE-407 net-imap has quadratic complexity when reading response literals
net-imap has quadratic complexity when reading response literals
### Summary
`Net::IMAP::ResponseReader` has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack.
### Details
For each literal in a response, `ResponseReader` rescans the entire growing response buffer. The regular expression that is used to scan the response buffer runs in linear time. With many literals, this becomes O(n²) total work. The regular expression should run in constant time: it is anchored to the end and only the last 23 bytes of the buffer are relevant.
Because the algorithmic complexity is super-linear, this bypasses protection from `max_response_size`: a respo
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-42245 ruby: Net::IMAP: Denial of Service via crafted IMAP responses [fedora-all]
bugzilla·2026-06-03·CVSS 2.3
CVE-2026-42245 [LOW] CVE-2026-42245 ruby: Net::IMAP: Denial of Service via crafted IMAP responses [fedora-all]
CVE-2026-42245 ruby: Net::IMAP: Denial of Service via crafted IMAP responses [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-42245 ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses
bugzilla·2026-05-09·CVSS 2.3
CVE-2026-42245 [LOW] CVE-2026-42245 ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses
CVE-2026-42245 ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
https://github.com/ruby/net-imap/commit/6091f7d6b1f3514cafbfe39c76f2b5d73de3ca96https://github.com/ruby/net-imap/commit/88d95231fc8afef11c1f074453f7d75b68c9dfdahttps://github.com/ruby/net-imap/commit/de685f91a4a4cc75eb80da898c2bf8af08d34819https://github.com/ruby/net-imap/releases/tag/v0.4.24https://github.com/ruby/net-imap/releases/tag/v0.5.14https://github.com/ruby/net-imap/releases/tag/v0.6.4https://github.com/ruby/net-imap/security/advisories/GHSA-q2mw-fvj9-vvcw
2026-05-09
Published