---
id: CVE-2026-42246
title: >-
  Net::IMAP implements Internet Message Access Protocol (IMAP) client
  functionality in Ruby
summary: >-
  Net::IMAP implements Internet Message Access Protocol (IMAP) client
  functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a
  man-in-the-middle attacker can cause Net::IMAP#starttls to return
  "successfully", without s…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-392
  - CWE-393
  - CWE-636
  - CWE-754
  - CWE-841
  - CWE-325
vendor: ruby-lang
product: 'net::imap'
affected:
  - 'net::imap < 0.3.10'
  - 'net::imap >= 0.4.0, < 0.4.24'
  - 'net::imap >= 0.5.0, < 0.5.14'
  - 'net::imap >= 0.6.0, < 0.6.4'
patched:
  - 'net::imap 0.6.4'
published: '2026-05-09'
updated: '2026-06-30'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42246'
references:
  - url: >-
      https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618
    label: security-advisories@github.com
  - url: >-
      https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e
    label: security-advisories@github.com
  - url: >-
      https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c
    label: security-advisories@github.com
  - url: >-
      https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da
    label: security-advisories@github.com
  - url: 'https://github.com/ruby/net-imap/releases/tag/v0.3.10'
    label: security-advisories@github.com
  - url: 'https://github.com/ruby/net-imap/releases/tag/v0.4.24'
    label: security-advisories@github.com
  - url: 'https://github.com/ruby/net-imap/releases/tag/v0.5.14'
    label: security-advisories@github.com
  - url: 'https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp'
    label: security-advisories@github.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:33462'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-42246'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2468499'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42246.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
epss: 0.00396
epssPercentile: 0.31097
ingestedAt: '2026-07-01T09:50:45.546Z'
---

## Overview

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.

## Affected

- `net::imap < 0.3.10`
- `net::imap >= 0.4.0, < 0.4.24`
- `net::imap >= 0.5.0, < 0.5.14`
- `net::imap >= 0.6.0, < 0.6.4`

## Remediation

Upgrade past the affected range:

- `net::imap 0.6.4`