216.73.216.233

CVE-2026-42246

· Published 09/05/2026 20:16 · Modified 09/05/2026 20:16

Labels: CVE-2026-42246 2026-05-09CVE-2026-42246CWE-392[email protected]

Essential information

Published
09/05/2026 20:16
Modified
09/05/2026 20:16
Author
—
Creator
—
CVSS
7.6 HIGH (v3) 7.6 HIGH (v4.0)
CISA KEV
No
CWE
—
CVSS vector
—

CVSS metrics

Description

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.

NVD status

Status
Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
ruby / net-imap cpe:2.3:a:ruby:net-imap:<0.3.10:*:*:*:*:*:*:*
ruby / net-imap cpe:2.3:a:ruby:net-imap:<0.4.24:*:*:*:*:*:*:*
ruby / net-imap cpe:2.3:a:ruby:net-imap:<0.5.14:*:*:*:*:*:*:*
ruby / net-imap cpe:2.3:a:ruby:net-imap:<0.6.4:*:*:*:*:*:*:*

References