Search for packages
| purl | pkg:gem/net-imap@0.4.24 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-52j7-95w6-k7hs
Aliases: CVE-2026-42256 GHSA-87pf-fpwv-p7m7 |
Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. |
|
|
VCID-5ysp-qzcr-6bhv
Aliases: CVE-2026-42245 GHSA-q2mw-fvj9-vvcw |
Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. |
|
|
VCID-hh1r-d7ku-s7gj
Aliases: CVE-2026-42258 GHSA-75xq-5h9v-w6px |
Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. |
|
|
VCID-jv8h-fa83-9uc6
Aliases: CVE-2026-42257 GHSA-hm49-wcqc-g2xg |
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4. |
Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. |
|
VCID-qts7-776s-duc8
Aliases: CVE-2026-42246 GHSA-vcgp-9326-pqcp |
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4. |
Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-52j7-95w6-k7hs |
CVE-2026-42256
GHSA-87pf-fpwv-p7m7 |
|
| VCID-5ysp-qzcr-6bhv |
CVE-2026-42245
GHSA-q2mw-fvj9-vvcw |
|
| VCID-hh1r-d7ku-s7gj |
CVE-2026-42258
GHSA-75xq-5h9v-w6px |
|
| VCID-jv8h-fa83-9uc6 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4. |
CVE-2026-42257
GHSA-hm49-wcqc-g2xg |
| VCID-qts7-776s-duc8 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4. |
CVE-2026-42246
GHSA-vcgp-9326-pqcp |