CVE-2026-42258

Name	CVE-2026-42258
Description	Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1136823

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ruby2.7 (PTS)	bullseye	2.7.4-1+deb11u1	vulnerable
	bullseye (security)	2.7.4-1+deb11u5	vulnerable
ruby3.1 (PTS)	bookworm, bookworm (security)	3.1.2-7+deb12u1	vulnerable
ruby3.3 (PTS)	trixie	3.3.8-2	vulnerable
	forky, sid	3.3.8-2.2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
ruby2.7	source	(unstable)	(unfixed)
ruby3.1	source	(unstable)	(unfixed)
ruby3.3	source	(unstable)	(unfixed)	1136823

https://github.com/ruby/net-imap/security/advisories/GHSA-75xq-5h9v-w6px
Net::IMAP embedded in src:ruby* source package