--- id: CVE-2026-47242 title: >- net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242) summary: >- A flaw was found in Net::IMAP, a Ruby library that implements Internet Message Access Protocol (IMAP) client functionality. This vulnerability arises from improper input validation when handling ID field values and arguments to the `enable… severity: high cvss: 7.3 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N' cvssSource: vendor cwe: - CWE-78 - CWE-77 - CWE-93 vendor: Red Hat product: Red Hat Enterprise Linux AppStream (v. 9) affected: - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_e4s_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - enterprise_linux_codeready_linux_builder_eus_v_10_0 - enterprise_linux_codeready_linux_builder_v_10 - hardened_images patched: - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_e4s_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - enterprise_linux_codeready_linux_builder_eus_v_10_0 - enterprise_linux_codeready_linux_builder_v_10 - hardened_images published: '2026-06-22' updated: '2026-10-16' sourceUpdated: '2026-10-16T17:25:46+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47242.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47242.json - url: 'https://access.redhat.com/security/cve/CVE-2026-47242' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2491522' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-47242' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47242' - url: 'https://github.com/ruby/net-imap/security/advisories/GHSA-46q3-7gv7-qmgg' - url: 'https://access.redhat.com/errata/RHSA-2026:54391' - url: 'https://access.redhat.com/errata/RHSA-2026:50778' - url: 'https://access.redhat.com/errata/RHSA-2026:50773' - url: 'https://access.redhat.com/errata/RHSA-2026:50728' - url: 'https://access.redhat.com/errata/RHSA-2026:54393' - url: 'https://access.redhat.com/errata/RHSA-2026:54416' - url: 'https://access.redhat.com/errata/RHSA-2026:50828' - url: 'https://access.redhat.com/errata/RHSA-2026:50827' - url: 'https://access.redhat.com/errata/RHSA-2026:40380' - url: 'https://access.redhat.com/errata/RHSA-2026:38694' - url: 'https://access.redhat.com/errata/RHSA-2026:34293' - url: 'https://access.redhat.com/errata/RHSA-2026:33551' - url: 'https://github.com/ruby/net-imap/releases/tag/v0.6.4.1' - url: >- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/net-imap/CVE-2026-47242.yml - url: 'https://github.com/advisories/GHSA-46q3-7gv7-qmgg' tags: - csaf - vex - red-hat - ghsa - rubygems epss: 0.00184 epssPercentile: 0.08033 aliases: - GHSA-46q3-7gv7-qmgg ecosystem: rubygems ingestedAt: '2026-07-07T15:41:59.601Z' --- ## Overview A flaw was found in Net::IMAP, a Ruby library that implements Internet Message Access Protocol (IMAP) client functionality. This vulnerability arises from improper input validation when handling ID field values and arguments to the `enable` command. A remote attacker could exploit this by injecting specially crafted input, leading to the execution of arbitrary IMAP commands. This could allow an attacker to manipulate IMAP sessions or access sensitive information. ## Vendor advisories - **RHSA-2026:54391** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54391) - **RHSA-2026:50778** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50778) - **RHSA-2026:50773** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50773) - **RHSA-2026:50728** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50728) - **RHSA-2026:54393** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54393) - **RHSA-2026:54416** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54416) - **RHSA-2026:50828** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50828) - **RHSA-2026:50827** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50827) - **RHSA-2026:40380** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:40380) - **RHSA-2026:38694** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38694) - **RHSA-2026:34293** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34293) **net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation** — rated Important by Red Hat. Released 2026-06-22, updated 2026-10-16. Fixed: - Red Hat Enterprise Linux AppStream EUS (v. 10.0) - Red Hat Enterprise Linux AppStream (v. 10) - Red Hat Enterprise Linux AppStream (v. 8) - Red Hat Enterprise Linux AppStream E4S (v.9.4) - Red Hat Enterprise Linux AppStream EUS (v.9.6) - Red Hat Enterprise Linux AppStream (v. 9) - Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) - Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) - Red Hat Hardened Images Not affected: - Red Hat 3scale API Management Platform 2 ## Remediation For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:54391 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:50778 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:50773 Workarounds / mitigations: - Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Update to the fixed version of affected product. ## Package advisory (CVE-2026-47242) Affected packages: - `net-imap >= 0.6.0, <= 0.6.4` - `net-imap <= 0.5.14` Patched in: - `net-imap 0.6.4.1` - `net-imap 0.5.15` Source: https://github.com/advisories/GHSA-46q3-7gv7-qmgg