| Name | CVE-2026-42258 |
| Description | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-6614-1 |
| Debian Bugs | 1136823 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| ruby3.1 (PTS) | bookworm, bookworm (security) | 3.1.2-7+deb12u1 | vulnerable |
| ruby3.3 (PTS) | trixie | 3.3.8-2 | vulnerable |
| trixie (security) | 3.3.13-0+deb13u1 | fixed | |
| forky, sid | 3.3.8-2.2 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| ruby2.7 | source | (unstable) | (unfixed) | |||
| ruby3.1 | source | (unstable) | (unfixed) | |||
| ruby3.3 | source | trixie | 3.3.13-0+deb13u1 | DSA-6614-1 | ||
| ruby3.3 | source | (unstable) | (unfixed) | 1136823 |
https://github.com/ruby/net-imap/security/advisories/GHSA-75xq-5h9v-w6px
Net::IMAP embedded in src:ruby* source package