CVE-2026-42257

A flaw was found in Net::IMAP (before 0.4.24, 0.5.14, and 0.6.4). Several commands accept raw string arguments sent to the server without validation or escaping; if derived from user-controlled input, CRLF sequences allow injection of arbitrary IMAP commands.

Net::IMAP is vulnerable to IMAP command injection in versions before 0.4.24, 0.5.14, and 0.6.4. Several client commands accept raw string arguments that are sent to the IMAP server without CRLF validation or escaping; if application code passes user-controlled data into those arguments, an attacker can inject additional IMAP commands by embedding carriage return and line feed sequences. Red Hat impact is concentrated in Ruby-based products that bundle a vulnerable net-imap gem, including RHEL Ruby module streams, OpenShift Serverless (hummingbird) Ruby runtimes, and 3scale AMP components (zync/system) that use Net::IMAP with externally influenced input; Perl IMAP client packages on Fedora are a separate codebase and are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.