CVE-2026-42258

What it actually does

The flaw is a CRLF injection / IMAP command injection issue in Ruby Net::IMAP before 0.4.24, 0.5.14, and 0.6.4. When an application passes attacker-influenced Ruby Symbol values into Net::IMAP command arguments, the library can serialize those symbols into the IMAP protocol stream without safely preventing carriage-return/line-feed sequence injection. An attacker who can influence such a Symbol argument can terminate the intended IMAP command and append additional IMAP commands that the Ruby client sends to the configured mail server using the client’s authenticated session. The most likely technical consequences are unauthorized mailbox operations, message state changes, folder manipulation, search/fetch abuse, or disruption of IMAP client workflows; this is not a general operating-system command execution issue.

Why it matters to the business

Applications that use affected Net::IMAP versions may allow a user-controlled value to be turned into unintended mail-server commands, potentially causing unauthorized changes to mailboxes, message flags, folders, or mail retrieval behavior. The severity is moderate because exploitation requires a specific application pattern, attacker influence over Symbol arguments, and user/application interaction, and there is no current evidence of broad exploitation, CISA KEV listing, or ransomware use. However, email systems often contain sensitive business communications, so affected applications should be patched during the next normal security maintenance window, or sooner for internet-facing or multi-user services that process untrusted mailbox names, flags, search keys, or IMAP command parameters.

How an attack unfolds

An attacker first identifies an application or service written in Ruby that uses Net::IMAP and exposes some input that eventually becomes a Symbol argument to an IMAP command. The attacker supplies a crafted value containing CRLF characters and an additional IMAP command payload. If the application converts or accepts that value as a Symbol and passes it into a vulnerable Net::IMAP method, the library constructs an IMAP protocol message where the injected CRLF ends the original command line. The mail server then receives one or more attacker-controlled IMAP commands in the context of the application’s authenticated IMAP session. Depending on the privileges of that session and the specific injected command, the attacker may alter message flags, select or manipulate mailboxes, retrieve messages, delete or move email, or cause command failures and service disruption. Exploitation is application-dependent and is not known to be actively exploited at scale based on the provided intelligence.

How to fix it

Upgrade the Ruby Net::IMAP package to a fixed version: 0.4.24 or later for the 0.4.x line, 0.5.14 or later for the 0.5.x line, or 0.6.4 or later for the 0.6.x line. In Bundler-managed applications, update the net-imap gem and verify Gemfile.lock reflects a fixed version. If Net::IMAP is supplied by the Ruby runtime or a distribution package, apply the vendor-provided Ruby or package update that includes the patched Net::IMAP release. As defense in depth, do not convert untrusted input directly into Symbols for IMAP commands; validate mailbox names, flags, and search parameters against strict allowlists; reject or escape carriage return and line feed characters; and prefer typed or library-provided constants over user-derived Symbols. If immediate upgrade is not possible, add input validation to block '\r', '\n', percent-encoded CR/LF, and any values that can alter IMAP command structure before they reach Net::IMAP.

How to confirm the fix worked

Confirm all deployed Ruby applications using Net::IMAP resolve to a fixed package version. Check dependency manifests and lockfiles, for example Gemfile.lock, gems.locked, gemspec files, container images, and packaged Ruby environments, for net-imap versions lower than 0.4.24, 0.5.14, or 0.6.4. Run `bundle info net-imap`, `bundle list | grep net-imap`, or equivalent software composition analysis tooling in build and runtime images. Review code paths for Net::IMAP command calls that accept Symbols and confirm untrusted input cannot become Symbol arguments. For functional validation, attempt to pass a benign test value containing CRLF characters through any user-controlled IMAP parameter in a non-production test environment and confirm the application rejects it or the patched library prevents command splitting. Monitor application and IMAP server logs after deployment for malformed command errors and verify normal mail workflows continue to operate.

Typical attack path

1. Find a Ruby application that uses a vulnerable Net::IMAP version before 0.4.24, 0.5.14, or 0.6.4.
2. Identify an input path that influences IMAP command arguments, especially mailbox names, flags, search criteria, labels, or other values that may be converted to Ruby Symbols.
3. Submit a crafted Symbol-compatible value containing CRLF characters followed by an additional IMAP command.
4. Trigger the application workflow that calls the affected Net::IMAP command.
5. Cause the Ruby IMAP client to send an unintended multi-command payload to the mail server over the authenticated IMAP connection.
6. Use the injected IMAP command to manipulate mailbox state, retrieve data available to the session, or disrupt mail-processing behavior.

How to detect it

There are no universal exploitation indicators for this vulnerability because payloads depend on the consuming application and the IMAP commands an attacker chooses to inject. To investigate prior exploitation, correlate Ruby application logs, reverse-proxy/request logs, and IMAP server audit logs for the period when vulnerable versions were deployed. Look for user-supplied values containing raw or encoded carriage returns and line feeds, such as `%0d%0a`, `\r\n`, or multi-line parameters, especially in fields related to mailbox names, folders, labels, flags, or search criteria. On IMAP servers, review sessions from application service accounts for unexpected command ordering, multiple commands arriving where the application normally sends one operation, abnormal `SELECT`, `EXAMINE`, `SEARCH`, `FETCH`, `STORE`, `COPY`, `MOVE`, `CREATE`, `DELETE`, `EXPUNGE`, or `UID` commands, and spikes in `BAD` or syntax-error responses. In Ruby application logs, investigate Net::IMAP protocol exceptions, failed mailbox operations, unusual user-triggered mail actions, or stack traces involving Net::IMAP immediately after suspicious request parameters. If available, compare IMAP audit activity against application-level business events to identify mailbox operations that were not initiated by legitimate workflows.

What your security team should do

• Inventory Ruby applications and services that include the net-imap gem or use Net::IMAP from the Ruby ecosystem.
• Prioritize patching internet-facing, multi-tenant, or user-driven applications that process untrusted mailbox names, flags, labels, or search parameters.
• Upgrade to Net::IMAP 0.4.24, 0.5.14, 0.6.4, or later, depending on the dependency line in use.
• Add dependency scanning rules to flag net-imap versions below the fixed releases in source repositories, CI pipelines, containers, and production images.
• Review application code for `to_sym`, `intern`, or direct Symbol creation from user input before calls to Net::IMAP methods.
• Add input validation that blocks CRLF and restricts IMAP-related values to expected character sets and known-safe options.
• Review IMAP server logs for suspicious command sequences, malformed commands, or unexpected mailbox operations from Ruby application accounts during the exposure window.
• Rotate IMAP credentials used by affected applications if logs suggest suspicious mailbox access or command injection activity.
• Because EPSS is low and the issue is not in KEV, handle as priority security maintenance unless the vulnerable pattern is confirmed in an exposed application.