Read the docs
TI-2026-34824 Aliases CVE-2026-47240GHSA-8p34-64r3-mwg8

Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument

Priority LOW 28CWE-77Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-77.

Summary

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing literals, it may still be possible to inject arbitrary IMAP commands inside non-synchronizing literals. A server without support for non-synchronizing literals may interpret the "+}\r\n" as the end of a malformed command line and respond with a tagged BAD. In that case, the contents of the literal will be interpreted as one or more new pipelined commands, allowing a CRLF command injection attack to succeed. This affects criteria for #search and #uid_search; search_keys for #sort, #thread, #uid_sort, and #uid_thread; and attr for #fetch and #uid_fetch. This vulnerability is fixed in 0.6.5 and 0.5.15.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00831 57th percentileScored 2026-11-07
Fix Fixed net-imap (ruby): 0.6.4.1, 0.5.15net-imap (RubyGems): 0.6.4.1, 0.5.15Red Hat: 7 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rubynet-imap0.6.0 to before 0.6.4.1; before 0.5.150.6.4.1, 0.5.15Patch availableCNA
—net-imap (RubyGems)0.6.0 to before 0.6.4.10.6.4.1Patch availableGHSA-8p34-64r3-mwg8
—net-imap (RubyGems)before 0.5.150.5.15Patch availableGHSA-8p34-64r3-mwg8
  • net-imap Vendorruby Affected 0.6.0 to before 0.6.4.1; before 0.5.15 Fixed in 0.6.4.1, 0.5.15 Patch available CNA
  • net-imap (RubyGems) Vendor— Affected 0.6.0 to before 0.6.4.1 Fixed in 0.6.4.1 Patch available GHSA-8p34-64r3-mwg8
  • net-imap (RubyGems) Vendor— Affected before 0.5.15 Fixed in 0.5.15 Patch available GHSA-8p34-64r3-mwg8

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:net\:*:*:*:*:*:*:*:*——ruby
  • cpe:2.3:a:ruby-lang:net\:*:*:*:*:*:*:*:* Versions — — ·ruby

Remediation

  • Fix · CNA net-imap (ruby) Fixed in 0.6.4.1, 0.5.15
  • Fix · GHSA-8p34-64r3-mwg8 net-imap (RubyGems) Fixed in 0.6.4.1 Advisory →
  • Fix · GHSA-8p34-64r3-mwg8 net-imap (RubyGems) Fixed in 0.5.15 Advisory →

Red Hat 7 advisories

  • RHSA-2026:50827 Released 2026-08-05 · Red Hat rating Important
    ruby:4.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) ruby-4.0.6-34.module+el9.8.0+24564+e55418dc.aarch64::ruby:4.0, ruby-4.0.6-34.module+el9.8.0+24564+e55418dc.i686::ruby:4.0, ruby-4.0.6-34.module+el9.8.0+24564+e55418dc.ppc64le::ruby:4.0 +47
  • RHSA-2026:50828 Released 2026-08-05 · Red Hat rating Important
    ruby:3.3 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) ruby-3.3.12-8.module+el9.8.0+24568+2bbebe96.aarch64::ruby:3.3, ruby-3.3.12-8.module+el9.8.0+24568+2bbebe96.i686::ruby:3.3, ruby-3.3.12-8.module+el9.8.0+24568+2bbebe96.ppc64le::ruby:3.3 +47
  • RHSA-2026:50778 Released 2026-08-05 · Red Hat rating Important
    ruby security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) ruby-3.3.12-14.el10_2, ruby-bundled-gems-3.3.12-14.el10_2, ruby-default-gems-3.3.12-14.el10_2 +20
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) ruby-doc-3.3.12-14.el10_2
Show 4 more Red Hat advisories
  • RHSA-2026:50773 Released 2026-08-05 · Red Hat rating Important
    ruby4.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) ruby4.0-4.0.6-36.el10_2, ruby4.0-devel-4.0.6-36.el10_2, ruby4.0-rubygem-mysql2-0.5.7-36.el10_2 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) ruby4.0-doc-4.0.6-36.el10_2
  • RHSA-2026:50728 Released 2026-08-05 · Red Hat rating Important
    ruby:3.3 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-3.3.12-8.module+el8.10.0+24567+c4e5368e.aarch64::ruby:3.3, ruby-3.3.12-8.module+el8.10.0+24567+c4e5368e.i686::ruby:3.3, ruby-3.3.12-8.module+el8.10.0+24567+c4e5368e.ppc64le::ruby:3.3 +47
  • RHSA-2026:40380 Released 2026-07-15 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images ruby3.3-3.3.10-23.4.hum1@aarch64, ruby3.3-3.3.10-23.4.hum1@src, ruby3.3-3.3.10-23.4.hum1@x86_64 +46
  • RHSA-2026:33551 Released 2026-06-30 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images ruby4.0-4.0.0-33.4.hum1@aarch64, ruby4.0-4.0.0-33.4.hum1@src, ruby4.0-4.0.0-33.4.hum1@x86_64 +46

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:50773, RHSA-2026:50778
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:50728
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:50827, RHSA-2026:50828
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:50773, RHSA-2026:50778
Red Hat Hardened ImagesFixed RHSA-2026:33551, RHSA-2026:40380
Not affected: 2 products
  • Red Hat 3scale API Management Platform 2
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47240
  2. 2026-10-03 Alias added: GHSA-8p34-64r3-mwg8

References

Advisory 1

Other 5

  • TI-2026-71508 Integer overflow in GitLab allows code execution on the server KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-50176 Use after free in ruby json CVSS 4.0HIGH 8.7
  • TI-2017-12709 Ruby before 2.4.3 allows Net::FTP command injection. CVSS 3.0HIGH 8.8
  • TI-2008-03501 Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value… CVSS 2.0HIGH 7.8
  • TI-2021-09891 In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web… CVSS 3.1HIGH 7.5
  • TI-2025-18855 Net::IMAP vulnerable to possible DoS by memory exhaustion CVSS 3.1MEDIUM 6.5
See all 135 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences