{"id":"CVE-2026-47242","title":"net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)","summary":"A flaw was found in Net::IMAP, a Ruby library that implements Internet Message Access Protocol (IMAP) client functionality. This vulnerability arises from improper input validation when handling ID field values and arguments to the `enable…","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cvssSource":"vendor","cwe":["CWE-78","CWE-77","CWE-93"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 9)","affected":["enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_e4s_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","enterprise_linux_codeready_linux_builder_eus_v_10_0","enterprise_linux_codeready_linux_builder_v_10","hardened_images"],"patched":["enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_e4s_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","enterprise_linux_codeready_linux_builder_eus_v_10_0","enterprise_linux_codeready_linux_builder_v_10","hardened_images"],"published":"2026-06-22","updated":"2026-10-16","sourceUpdated":"2026-10-16T17:25:46+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47242.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47242.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-47242"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491522"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47242"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47242"},{"url":"https://github.com/ruby/net-imap/security/advisories/GHSA-46q3-7gv7-qmgg"},{"url":"https://access.redhat.com/errata/RHSA-2026:54391"},{"url":"https://access.redhat.com/errata/RHSA-2026:50778"},{"url":"https://access.redhat.com/errata/RHSA-2026:50773"},{"url":"https://access.redhat.com/errata/RHSA-2026:50728"},{"url":"https://access.redhat.com/errata/RHSA-2026:54393"},{"url":"https://access.redhat.com/errata/RHSA-2026:54416"},{"url":"https://access.redhat.com/errata/RHSA-2026:50828"},{"url":"https://access.redhat.com/errata/RHSA-2026:50827"},{"url":"https://access.redhat.com/errata/RHSA-2026:40380"},{"url":"https://access.redhat.com/errata/RHSA-2026:38694"},{"url":"https://access.redhat.com/errata/RHSA-2026:34293"},{"url":"https://access.redhat.com/errata/RHSA-2026:33551"},{"url":"https://github.com/ruby/net-imap/releases/tag/v0.6.4.1"},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/net-imap/CVE-2026-47242.yml"},{"url":"https://github.com/advisories/GHSA-46q3-7gv7-qmgg"}],"tags":["csaf","vex","red-hat","ghsa","rubygems"],"epss":0.00184,"epssPercentile":0.07876,"aliases":["GHSA-46q3-7gv7-qmgg"],"ecosystem":"rubygems","ingestedAt":"2026-07-07T15:41:59.601Z","slug":"CVE-2026-47242","body":"## Overview\n\nA flaw was found in Net::IMAP, a Ruby library that implements Internet Message Access Protocol (IMAP) client functionality. This vulnerability arises from improper input validation when handling ID field values and arguments to the `enable` command. A remote attacker could exploit this by injecting specially crafted input, leading to the execution of arbitrary IMAP commands. This could allow an attacker to manipulate IMAP sessions or access sensitive information.\n\n## Vendor advisories\n\n- **RHSA-2026:54391** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54391)\n- **RHSA-2026:50778** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50778)\n- **RHSA-2026:50773** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50773)\n- **RHSA-2026:50728** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50728)\n- **RHSA-2026:54393** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54393)\n- **RHSA-2026:54416** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54416)\n- **RHSA-2026:50828** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50828)\n- **RHSA-2026:50827** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50827)\n- **RHSA-2026:40380** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:40380)\n- **RHSA-2026:38694** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38694)\n- **RHSA-2026:34293** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34293)\n\n**net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation** — rated Important by Red Hat. Released 2026-06-22, updated 2026-10-16.\n\nFixed:\n\n- Red Hat Enterprise Linux AppStream EUS (v. 10.0)\n- Red Hat Enterprise Linux AppStream (v. 10)\n- Red Hat Enterprise Linux AppStream (v. 8)\n- Red Hat Enterprise Linux AppStream E4S (v.9.4)\n- Red Hat Enterprise Linux AppStream EUS (v.9.6)\n- Red Hat Enterprise Linux AppStream (v. 9)\n- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)\n- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)\n- Red Hat Hardened Images\n\nNot affected:\n\n- Red Hat 3scale API Management Platform 2\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:54391\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:50778\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:50773\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Update to the fixed version of affected product.\n\n## Package advisory (CVE-2026-47242)\n\nAffected packages:\n\n- `net-imap >= 0.6.0, <= 0.6.4`\n- `net-imap <= 0.5.14`\n\nPatched in:\n\n- `net-imap 0.6.4.1`\n- `net-imap 0.5.15`\n\nSource: https://github.com/advisories/GHSA-46q3-7gv7-qmgg","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":223808,"id":"CVE-2026-47242","ts":1792238437889,"field":"cvss","old":null,"new":"7.3"},{"seq":223807,"id":"CVE-2026-47242","ts":1792238437889,"field":"severity","old":"medium","new":"high"}]}