Read the docs
TI-2026-30572 Aliases CVE-2026-42256GHSA-87pf-fpwv-p7m7

net-imap: Denial of service via high iteration count for `SCRAM-*` authentication

Priority LOW 27CWE-1322Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00299 22nd percentileScored 2026-11-07
Fix Partial net-imap (ruby): 0.4.24, 0.5.14, 0.6.4net-imap (RubyGems): 0.6.4, 0.5.14, 0.4.24Red Hat: 9 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rubynet-imap0.4.0 to before 0.4.24; 0.5.0 to before 0.5.14; 0.6.0 to before 0.6.40.4.24, 0.5.14, 0.6.4Patch availableCNA
—net-imap (RubyGems)0.6.0 to before 0.6.40.6.4Patch availableGHSA-87pf-fpwv-p7m7
—net-imap (RubyGems)0.5.0 to before 0.5.140.5.14Patch availableGHSA-87pf-fpwv-p7m7
—net-imap (RubyGems)0.4.0 to before 0.4.240.4.24Patch availableGHSA-87pf-fpwv-p7m7
  • net-imap Vendorruby Affected 0.4.0 to before 0.4.24; 0.5.0 to before 0.5.14; 0.6.0 to before 0.6.4 Fixed in 0.4.24, 0.5.14, 0.6.4 Patch available CNA
  • net-imap (RubyGems) Vendor— Affected 0.6.0 to before 0.6.4 Fixed in 0.6.4 Patch available GHSA-87pf-fpwv-p7m7
  • net-imap (RubyGems) Vendor— Affected 0.5.0 to before 0.5.14 Fixed in 0.5.14 Patch available GHSA-87pf-fpwv-p7m7
  • net-imap (RubyGems) Vendor— Affected 0.4.0 to before 0.4.24 Fixed in 0.4.24 Patch available GHSA-87pf-fpwv-p7m7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:net\:\:imap:*:*:*:*:*:ruby:*:* imapVulnerableruby
  • cpe:2.3:a:ruby-lang:net\:\:imap:*:*:*:*:*:ruby:*:* Versions imap Vulnerable ·ruby

Remediation

  • Fix · CNA net-imap (ruby) Fixed in 0.4.24, 0.5.14, 0.6.4
  • Fix · GHSA-87pf-fpwv-p7m7 net-imap (RubyGems) Fixed in 0.6.4 Advisory →
  • Fix · GHSA-87pf-fpwv-p7m7 net-imap (RubyGems) Fixed in 0.5.14 Advisory →
  • Fix · GHSA-87pf-fpwv-p7m7 net-imap (RubyGems) Fixed in 0.4.24 Advisory →

Red Hat 9 advisories

  • RHSA-2026:50827 Released 2026-08-05 · Red Hat rating Important
    ruby:4.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) ruby-4.0.6-34.module+el9.8.0+24564+e55418dc.aarch64::ruby:4.0, ruby-4.0.6-34.module+el9.8.0+24564+e55418dc.i686::ruby:4.0, ruby-4.0.6-34.module+el9.8.0+24564+e55418dc.ppc64le::ruby:4.0 +47
  • RHSA-2026:50828 Released 2026-08-05 · Red Hat rating Important
    ruby:3.3 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) ruby-3.3.12-8.module+el9.8.0+24568+2bbebe96.aarch64::ruby:3.3, ruby-3.3.12-8.module+el9.8.0+24568+2bbebe96.i686::ruby:3.3, ruby-3.3.12-8.module+el9.8.0+24568+2bbebe96.ppc64le::ruby:3.3 +47
  • RHSA-2026:50778 Released 2026-08-05 · Red Hat rating Important
    ruby security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) ruby-3.3.12-14.el10_2, ruby-bundled-gems-3.3.12-14.el10_2, ruby-default-gems-3.3.12-14.el10_2 +20
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) ruby-doc-3.3.12-14.el10_2
Show 6 more Red Hat advisories
  • RHSA-2026:50773 Released 2026-08-05 · Red Hat rating Important
    ruby4.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) ruby4.0-4.0.6-36.el10_2, ruby4.0-devel-4.0.6-36.el10_2, ruby4.0-rubygem-mysql2-0.5.7-36.el10_2 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) ruby4.0-doc-4.0.6-36.el10_2
  • RHSA-2026:50728 Released 2026-08-05 · Red Hat rating Important
    ruby:3.3 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-3.3.12-8.module+el8.10.0+24567+c4e5368e.aarch64::ruby:3.3, ruby-3.3.12-8.module+el8.10.0+24567+c4e5368e.i686::ruby:3.3, ruby-3.3.12-8.module+el8.10.0+24567+c4e5368e.ppc64le::ruby:3.3 +47
  • RHSA-2026:38694 Released 2026-07-13 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images ruby3.4-3.4.10-31.hum1@aarch64, ruby3.4-3.4.10-31.hum1@src, ruby3.4-3.4.10-31.hum1@x86_64 +46
  • RHSA-2026:33721 Released 2026-06-30 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images ruby3.3-3.3.10-23.2.hum1@aarch64, ruby3.3-3.3.10-23.2.hum1@src, ruby3.3-3.3.10-23.2.hum1@x86_64 +46
  • RHSA-2026:33552 Released 2026-06-30 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images ruby3.4-3.4.8-31.2.hum1@aarch64, ruby3.4-3.4.8-31.2.hum1@src, ruby3.4-3.4.8-31.2.hum1@x86_64 +46
  • RHSA-2026:33551 Released 2026-06-30 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images ruby4.0-4.0.0-33.4.hum1@aarch64, ruby4.0-4.0.0-33.4.hum1@src, ruby4.0-4.0.0-33.4.hum1@x86_64 +46

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:50773, RHSA-2026:50778
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:50728
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:50827, RHSA-2026:50828
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:50773, RHSA-2026:50778
Red Hat Hardened ImagesFixed RHSA-2026:33551, RHSA-2026:33552, RHSA-2026:33721, RHSA-2026:38694

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42256
  2. 2026-10-03 Alias added: GHSA-87pf-fpwv-p7m7
  3. 2026-11-06 Affected versions changed · Red Hat

References

Patch 3

Advisory 2

Other 6

  • TI-2026-30563 net-imap vulnerable to STARTTLS stripping via invalid response timing CVSS 4.0HIGH 7.6
  • TI-2026-30574 net-imap: Command Injection via unvalidated Symbol inputs CVSS 4.0MEDIUM 5.8
  • TI-2025-28441 net-imap rubygem vulnerable to possible DoS by memory exhaustion CVSS 4.0MEDIUM 6.0
  • TI-2026-30573 net-imap: Command Injection via "raw" arguments to multiple commands CVSS 4.0MEDIUM 5.8
  • TI-2026-30562 net-imap: Quadratic complexity when reading response literals CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences