CVE-2026-42245

A flaw was found in Net::IMAP, a Ruby library implementing the Internet Message Access Protocol (IMAP) client functionality. A hostile server can exploit a quadratic time complexity issue in the Net::IMAP::ResponseReader when processing large responses containing numerous string literals. This can lead to the client's CPU being exhausted, resulting in a denial of service (DoS) attack.

Red Hat has rated this flaw as Moderate because a malicious IMAP server can trigger excessive CPU consumption, resulting in a denial-of-service (DoS) condition in client applications using the affected Net::IMAP library. Successful exploitation requires interaction with a hostile server, and the impact is strictly limited to resource exhaustion of the client process. The vulnerability does not allow code execution, privilege escalation, or unauthorized access to data.

Regarding Red Hat Satellite: the Satellite-shipped puppet-agent package may include Net::IMAP / net-imap files under /opt/puppetlabs as part of the bundled Puppet Ruby runtime. Satellite does not use Net::IMAP for its supported email notification functionality (SMTP is used instead), and the vulnerable IMAP client operations are not exercised on a supported Satellite attack path. Presence of these files in puppet-agent therefore does not change the assessment that these CVEs are not applicable to Red Hat Satellite. Scanner findings based solely on on-disk gem presence should be treated as false positives for Satellite product impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce the risk of a denial of service, ensure that applications using the Net::IMAP library are configured to connect exclusively to trusted IMAP servers. Avoid connecting to untrusted or unverified IMAP services, as a hostile server can exploit this vulnerability. This operational control helps prevent exposure to malicious IMAP response processing.