PT-2026-36986 · Cpan · Net::Imap

Masamuneee · Published 2026-05-04 · Updated 2026-05-16 · CVE-2026-42245

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Net::IMAP (affected versions not specified)

Description Net::IMAP::ResponseReader exhibits quadratic time complexity when processing large responses containing numerous string literals. A hostile server can send specially crafted responses that force the ResponseReader to rescan the entire growing response buffer for each literal, leading to excessive CPU consumption and a denial of service. This algorithmic complexity allows the issue to bypass max response size protections, as a response can remain below the size limit while still incurring high CPU costs. Because the process retains the Global VM lock during scanning, other threads are significantly impacted.

Recommendations Upgrade to a patched version of net-imap. Avoid connecting to untrusted IMAP servers. When connecting to untrusted servers, reduce max response size to a much smaller value, such as 8KiB, to limit the impact.

Exploit

Fix

DoS

Weakness Enumeration

CWE-407

Related Identifiers

CVE-2026-42245

GHSA-Q2MW-FVJ9-VVCW

Affected Products

Net::Imap

References · 23

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/net-imap/CVE-2026-42245.yml · Exploit
• https://github.com/ruby/net-imap/security/advisories/GHSA-q2mw-fvj9-vvcw · Vendor Advisory
• https://github.com/ruby/net-imap/commit/6091f7d6b1f3514cafbfe39c76f2b5d73de3ca96 · Patch
• https://github.com/ruby/net-imap/commit/88d95231fc8afef11c1f074453f7d75b68c9dfda · Patch
• https://github.com/ruby/net-imap/commit/de685f91a4a4cc75eb80da898c2bf8af08d34819 · Patch
• https://cve.org/CVERecord?id=CVE-2026-42245 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42245 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-42245 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42245 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-42245 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42245 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42245 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q2mw-fvj9-vvcw · Vendor Advisory
• https://github.com/ruby/net-imap/releases/tag/v0.6.4 · Note
• https://github.com/ruby/net-imap/releases/tag/v0.4.24 · Note