CVE-2026-42258 net-imap: Command Injection via unvalidated Symbol inputs

Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched ...

CVE-2026-42258

CVE-2026-42258 affects the Ruby Net::IMAP client. The issue is a CRLF/IMAP command injection via symbol arguments passed to commands, exploitable in versions prior to 0.4.24, 0.5.14, and 0.6.4. The vulnerability root cause is unvalidated Symbol inputs being used in IMAP command handling, enabling...

net-imap vulnerable to command Injection via unvalidated Symbol inputs

Summary Symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. Details Symbol arguments represent IMAP "system flags", which are formatted as "atoms" with no quoting with a "" prefix. Vulnerable versions of Net::IMAP...