Is CVE-2026-42257 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42257 being exploited in the wild.

How severe is CVE-2026-42257?

Critical severity, with a CVSS score of 9.8, published 9 May 2026.

Which products and versions are affected?

net-imap (RubyGems) ECOSYSTEM:introduced=0.6.0,fixed=0.6.4.

Is there a fix for CVE-2026-42257?

Yes. net-imap (RubyGems): upgrade to 0.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42257 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42257?

Check whether you run net-imap (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42257: Ruby Net::IMAP command injection in multiple commands

CVE-2026-42257 · Severity: critical · CVSS 9.8 · Published 2026-05-09

The net-imap library, a tool used by Ruby applications to communicate with email servers, is vulnerable to command injection. If an application uses this library to process user-provided search terms or email attributes without proper validation, an attacker could inject malicious commands. This could allow an attacker to perform unauthorized actions on a user's mailbox, such as deleting emails or modifying folder structures.

Technologies: net-imap (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-42257 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42257 being exploited in the wild.
How severe is CVE-2026-42257?: Critical severity, with a CVSS score of 9.8, published 9 May 2026.
Which products and versions are affected?: net-imap (RubyGems) ECOSYSTEM:introduced=0.6.0,fixed=0.6.4.
Is there a fix for CVE-2026-42257?: Yes. net-imap (RubyGems): upgrade to 0.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42257 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42257?: Check whether you run net-imap (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

net-imap (RubyGems): upgrade to 0.6.4 or later
```
bundle update net-imap
```

Technical details

The net-imap library contains a command injection vulnerability where several methods (including #search, #fetch, #store, and #setquota) treat certain string arguments as 'raw data'. This bypasses the library's standard IMAP 'astring' encoding and validation, allowing CRLF sequences to be passed directly to the socket. An attacker can exploit this by providing specially crafted input that includes CRLF sequences followed by arbitrary IMAP commands (e.g., DELETE). The vulnerability is rooted in the use of Net::IMAP::RawData for specific arguments without neutralization. Patches have been released in versions 0.6.4, 0.5.14, and 0.4.24 which implement validation for raw data and transition certain methods away from raw data handling.

Affected products

Ruby net-imap >= 0.6.0, <= 0.6.3; >= 0.5.0, <= 0.5.13; <= 0.4.23

Identifiers

CVE-2026-42257
GHSA-hm49-wcqc-g2xg

Timeline

2026-04-24: disclosed: Vulnerability reported to ruby/net-imap
2026-05-04: advisory: GitHub Advisory published
2026-05-09: other: NVD published date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.