CVE-2026-47242High· 7.3▾ TwilightA flaw was found in Net::IMAP, a Ruby library that implements Internet Message Access Protocol (IMAP) client functionality. This vulnerability arises from improper input validation when handling ID field values and arguments to the `enable…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.1%
0.1% → 0.2%
Last analysed / modified upstream
— → 7.3
medium → high
A flaw was found in Net::IMAP, a Ruby library that implements Internet Message Access Protocol (IMAP) client functionality. This vulnerability arises from improper input validation when handling ID field values and arguments to the enable command. A remote attacker could exploit this by injecting specially crafted input, leading to the execution of arbitrary IMAP commands. This could allow an attacker to manipulate IMAP sessions or access sensitive information.
net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation — rated Important by Red Hat. Released 2026-06-22, updated 2026-10-16.
Fixed:
Not affected:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:54391 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:50778 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:50773
Workarounds / mitigations:
Affected packages:
net-imap >= 0.6.0, <= 0.6.4net-imap <= 0.5.14Patched in:
net-imap 0.6.4.1net-imap 0.5.15Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-37371Medium· 6.5krb5: GSS message token handling (CVE-2024-37371)
CVE-2025-24898Medium· 4.8rust-openssl: rust openssl ssl::select_next_proto use after free (CVE-2025-24898)
CVE-2026-63381Medium· 6.6Libevent is an event notification library
CVE-2026-73066High· 7.1Tesseract is an open source OCR engine
CVE-2026-66373High· 7.5Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting…
CVE-2026-85504Critical· 9.8FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.