Executive brief
A vulnerability in the Ruby net-imap library, which is used by applications to communicate with email servers, could allow an attacker to inject unauthorized commands. If an application passes untrusted user input as a 'Symbol' to this library, an attacker could potentially delete mailboxes or perform other unauthorized email operations. This could lead to data loss or disruption of email services for affected users.
Technical details
The net-imap library fails to validate Symbol arguments, which are used to represent IMAP 'system flags'. Because these symbols are sent directly to the socket with a '\' prefix and no quoting or validation, an attacker can provide a Symbol containing CRLF sequences or spaces. This enables CRLF injection, allowing the attacker to terminate the intended IMAP command and inject arbitrary new commands (e.g., DELETE). The vulnerability is exploitable if the calling application converts untrusted user input into Symbols (via #to_sym or unsafe deserialization) before passing them to net-imap methods. Patches are available in versions 0.6.4, 0.5.14, and 0.4.24.
Affected products
- Ruby net-imap >= 0.6.0, <= 0.6.3
- Ruby net-imap >= 0.5.0, <= 0.5.13
- Ruby net-imap <= 0.4.23
Timeline
- 2026-04-24: disclosed: Initial disclosure in ruby/net-imap
- 2026-04-24: patched: Fixes released in versions 0.4.24, 0.5.14, and 0.6.4
- 2026-05-04: advisory: GitHub Advisory published
- 2026-05-09: other: NVD publication date