> CVE-2026-42245 [LOW]

« BACK_TO_HOME
PUBLISHED
2026-05-09 20:16
MODIFIED
2026-05-09 20:16
CVSS_SCORE V3
2.3
EPSS (Prob. Exploit)
0.70%
Top 47.3%
DATA SOURCES:
NVD đź”— 2026-05-09 CWE MITRE đź”— 2026-11-01 FIRST EPSS đź”— 2026-10-25 GITHUB đź”— 2026-10-29

> DESCRIPTION

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> CVSS V3 METRICS

CVSS_VECTOR
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

> MÉTRIQUES CVSS DÉTAILLÉES

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Métrique Valeur Interprétation
AV (Vecteur d'Attaque)
Attack Vector
Network (N)
Exploit possible à distance via réseau (HTTP, API, etc.)
AC (Complexité d'Attaque)
Attack Complexity
Low (L)
Peu de conditions requises pour exploiter
PR (Privilèges Requis)
Privileges Required
None (N)
Aucune authentification requise
UI (Interaction Utilisateur)
User Interaction
Unknown (P)
Interaction inconnue
S (Périmètre)
Scope
Unchanged (U)
Impact reste dans le périmètre du composant compromis
C (Impact Confidentialité)
Confidentiality Impact
None (N)
Aucune divulgation d'informations
I (Impact Intégrité)
Integrity Impact
None (N)
Aucune modification de données possible
A (Impact Disponibilité)
Availability Impact
Low (L)
Interruption partielle du service possible

> RÉSUMÉ DES IMPACTS

Confidentialité
None
Aucune divulgation d'informations
Intégrité
None
Aucune modification de données possible
Disponibilité
Low
Interruption partielle du service possible

> WEAKNESSES

CWE-407

> CWE DETAILED DESCRIPTIONS

CWE-407: Inefficient Algorithmic Complexity - An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: ruby:3.3 security update
An update for the ruby:3.3 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scor...
Red Hat Security Advisory: ruby security update
An update for ruby is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CV...
Red Hat Security Advisory: ruby4.0 security update
An update for ruby4.0 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available.
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available.
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available.
Red Hat Security Advisory: ruby:4.0 security update
An update for the ruby:4.0 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scor...
Red Hat Security Advisory: ruby:3.3 security update
An update for the ruby:3.3 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scor...
Red Hat Security Advisory: ruby security update
An update for ruby is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulner...
Red Hat Security Advisory: ruby:3.3 security update
An update for the ruby:3.3 module is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Im...
Red Hat Security Advisory: ruby:3.3 security update
An update for the ruby:3.3 module is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A...
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available.

> GITHUB SECURITY ADVISORY

GHSA-q2mw-fvj9-vvcw LOW

net-imap has quadratic complexity when reading response literals

AFFECTED PACKAGES:
RUBYGEMS / net-imap
>= 0, <= 0.4.23
Fixed in: 0.4.24
RUBYGEMS / net-imap
>= 0.5.0, <= 0.5.13
Fixed in: 0.5.14
RUBYGEMS / net-imap
>= 0.6.0, <= 0.6.3
Fixed in: 0.6.4

> HISTORIQUE DES MODIFICATIONS

Première apparition
09/05/2026 20:16
Source: NVD
đź“Š ENRICHISSEMENT 01/06/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-407: Inefficient Algorithmic Complexity - An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an ...
Total des modifications: 1 Dernière mise à jour: 5 months ago

> REFERENCES

https://github.com/ruby/net-imap/commit/6091f7d6b1f3514cafbfe39c76f2b5d73de3ca96
https://github.com/ruby/net-imap/commit/88d95231fc8afef11c1f074453f7d75b68c9dfda
https://github.com/ruby/net-imap/commit/de685f91a4a4cc75eb80da898c2bf8af08d34819
https://github.com/ruby/net-imap/releases/tag/v0.4.24
https://github.com/ruby/net-imap/releases/tag/v0.5.14
https://github.com/ruby/net-imap/releases/tag/v0.6.4
https://github.com/ruby/net-imap/security/advisories/GHSA-q2mw-fvj9-vvcw
« BACK_TO_HOME