Back to overview

CVE-2026-47241

LOW
2.1
CVSS 4.0
Description
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and then sent verbatim. If this string is derived from user-controlled input, an attacker can force the next command to be absorbed as a continuation of the first command. This will cause the first command to eventually fail, but also prevents it from returning until another command is sent (from another thread). That other command will not return until the connection is closed. This vulnerability is fixed in 0.6.5 and 0.5.15.

Metadata

CVE ID
CVE-2026-47241
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-18 22:54 UTC
Published
2026-06-22 20:11 UTC
Last updated
2026-06-22 20:11 UTC
Primary CWE
CWE-162
CWE-162: Improper Neutralization of Trailing Special Element…
Vendor / Product
ruby / net-imap
Sources
cve.org  ·  NVD

Severity & Metrics

2.1 LOW CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products (1)
VendorProductPlatformVersions
ruby net-imap — >= 0.6.0, < 0.6.4.1, < 0.5.15
Weakness (CWE)
CWESourceDescription
CWE-162 cna CWE-162: Improper Neutralization of Trailing Special Elements
CWE-182 cna CWE-182: Collapse of Data into Unsafe Value
CWE-186 cna CWE-186: Overly Restrictive Regular Expression
CVSS scores (1)
ScoreSeverityVersionSourceVector
2.1 LOW 4.0 cna CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References (1)
Back to overview