Junglewise Threat Intelligence

CVE-2026-42246: Ruby Net::IMAP STARTTLS stripping vulnerability

CVE-2026-42246 · Severity: high · CVSS 7.4 · Published 2026-05-09

Vendors: Ruby.

Executive brief

A security flaw in the Ruby Net::IMAP library, which handles email communication for Ruby applications, allows attackers to bypass encryption. By intercepting the connection, an attacker can trick the application into believing a secure connection has been established when it is actually sending data in plain text. This could lead to the theft of sensitive email content or login credentials.

Technical details

A STARTTLS stripping vulnerability exists in the Ruby Net::IMAP library. The root cause is an improper check for unusual or exceptional conditions during the TLS handshake negotiation, specifically within the Net::IMAP#starttls method. A man-in-the-middle (MITM) attacker can intercept the communication and manipulate the server's response to make the client believe encryption was successfully initiated while the connection remains in plaintext. This allows the attacker to read or modify sensitive IMAP traffic. The issue is patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.

Affected products

  • Ruby Net::IMAP < 0.3.10, 0.4.0 - 0.4.23, 0.5.0 - 0.5.13, 0.6.0 - 0.6.3

Timeline

  • 2026-05-09: advisory: Initial disclosure by GitHub, Inc.
  • 2026-04-23: patched: Patched versions released.

References