CVE-2026-42246
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.6
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.31%
- CWE
- CWE-392, CWE-393, CWE-754, CWE-636, CWE-841
- Published
- 2026-05-09
- Last modified
- 2026-08-24
Affected products
- ruby net-imap
- ruby net-imap
- ruby net-imap
- ruby net-imap
Weakness type
Related vulnerabilities
- CVE-2026-20005 — Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could...
- CVE-2025-59398 — The OCPP implementation in libocpp before 0.26.2 allows a denial of service (EVerest crash) via...
- CVE-2025-23270 — NVIDIA Jetson Linux contains a vulnerability in UEFI Management mode, where an unprivileged local...
- CVE-2025-26268 — DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service (daemon...
- CVE-2025-32743 — In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c can be NULL or an empty...
- CVE-2024-12797 — RFC7250 handshakes with unauthenticated servers don't abort as expected
- CVE-2024-39697 — phonenumber panics on parsing crafted phonenumber inputs
- CVE-2023-48430 — A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The REST API...