p PatchFirst

CVE-2026-42245

CVE-2026-42245 · net-imap: Quadratic complexity when reading response literals

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

CVSS 2.3 · Low · EPSS 0.4%

Published
Updated

Stack: system

Affected products and versions

  • net-imap

    Versions
    • < 0.4.24: Affected
    • >= 0.5.0, < 0.5.14: Affected
    • >= 0.6.0, < 0.6.4: Affected

    No fix published

  • ruby3.1 Debian:12

    Versions
    • 3.1.2-7
    • 3.1.2-7+deb12u1
    • 3.1.2-7+hurd.1
    • 3.1.2-8
    • 3.1.2-8.1~exp1
    • 3.1.2-8.3
    • 3.1.2-8.4
    • 3.1.2-8.5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby3.3 Debian:13

    Versions
    • 3.3.8-2
    • 3.3.8-2.1
    • 3.3.8-2.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby3.3 Debian:14

    Versions
    • 3.3.8-2
    • 3.3.8-2.1
    • 3.3.8-2.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jruby Ubuntu:25.10

    Versions
    • 9.4.8.0+ds-2ubuntu1
    • 9.4.8.0+ds-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby3.3 Ubuntu:25.10

    Versions
    • 3.3.7-1ubuntu2
    • 3.3.8-2ubuntu1
    • 3.3.8-2ubuntu2
    • 3.3.8-2ubuntu2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jruby Ubuntu:26.10

    Versions
    • 9.4.8.0+ds-3ubuntu1
    • 9.4.14.0+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby3.3 Ubuntu:26.10

    Versions
    • 3.3.8-2ubuntu3
    • 3.3.8-2.2ubuntu4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →