{"id":"CVE-2026-42246","title":"Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby","summary":"Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return \"successfully\", without s…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-392","CWE-393","CWE-636","CWE-754","CWE-841","CWE-325"],"vendor":"ruby-lang","product":"net::imap","affected":["net::imap < 0.3.10","net::imap >= 0.4.0, < 0.4.24","net::imap >= 0.5.0, < 0.5.14","net::imap >= 0.6.0, < 0.6.4"],"patched":["net::imap 0.6.4"],"published":"2026-05-09","updated":"2026-06-30","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42246","references":[{"url":"https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618","label":"security-advisories@github.com"},{"url":"https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e","label":"security-advisories@github.com"},{"url":"https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c","label":"security-advisories@github.com"},{"url":"https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da","label":"security-advisories@github.com"},{"url":"https://github.com/ruby/net-imap/releases/tag/v0.3.10","label":"security-advisories@github.com"},{"url":"https://github.com/ruby/net-imap/releases/tag/v0.4.24","label":"security-advisories@github.com"},{"url":"https://github.com/ruby/net-imap/releases/tag/v0.5.14","label":"security-advisories@github.com"},{"url":"https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:33462","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-42246","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468499","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42246.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"tags":["nvd"],"epss":0.00312,"epssPercentile":0.2429,"ingestedAt":"2026-07-01T09:50:45.546Z","slug":"CVE-2026-42246","body":"## Overview\n\nNet::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return \"successfully\", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.\n\n## Affected\n\n- `net::imap < 0.3.10`\n- `net::imap >= 0.4.0, < 0.4.24`\n- `net::imap >= 0.5.0, < 0.5.14`\n- `net::imap >= 0.6.0, < 0.6.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `net::imap 0.6.4`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}