# CVE-2026-42246

## Summary

- **CVE ID:** CVE-2026-42246
- **Severity:** HIGH
- **CVSS Score:** 7.6 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N)
- **CWE:** CWE-392, CWE-393, CWE-754, CWE-636, CWE-841
- **Published:** May 9, 2026
- **Last Modified:** Aug 24, 2026

## Description

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.

## Affected Products

- ruby — net-imap (< 0.3.10)
- ruby — net-imap (>= 0.4.0, < 0.4.24)
- ruby — net-imap (>= 0.5.0, < 0.5.14)
- ruby — net-imap (>= 0.6.0, < 0.6.4)

## References

- [CNA](https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp)
- [CNA](https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618)
- [CNA](https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e)
- [CNA](https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c)
- [CNA](https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da)
- [CNA](https://github.com/ruby/net-imap/releases/tag/v0.3.10)
- [CNA](https://github.com/ruby/net-imap/releases/tag/v0.4.24)
- [CNA](https://github.com/ruby/net-imap/releases/tag/v0.5.14)
- [redhat-SADP](https://access.redhat.com/security/cve/CVE-2026-42246)
- [redhat-SADP](https://bugzilla.redhat.com/show_bug.cgi?id=2468499)
- [redhat-SADP](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42246.json)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33462)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33565)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33540)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33514)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33515)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33630)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33512)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33576)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33577)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33721)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33552)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33551)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34076)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:35866)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:35867)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:35834)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:35895)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36099)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:37397)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:37238)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.31%
- **EPSS Percentile:** 23.9

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._