CVE-2026-42246
CVE-2026-42246 · net-imap vulnerable to STARTTLS stripping via invalid response timing
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.
CVSS 7.6 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
net-imap
- Versions
- < 0.3.10: Affected
- >= 0.4.0, < 0.4.24: Affected
- >= 0.5.0, < 0.5.14: Affected
- >= 0.6.0, < 0.6.4: Affected
No fix published
ruby3.1 Debian:12
- Versions
- 3.1.2-7
- 3.1.2-7+deb12u1
- 3.1.2-7+hurd.1
- 3.1.2-8
- 3.1.2-8.1~exp1
- 3.1.2-8.3
- 3.1.2-8.4
- 3.1.2-8.5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby3.3 Debian:13
- Versions
- 3.3.8-2
- 3.3.8-2.1
- 3.3.8-2.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby3.3 Debian:14
- Versions
- 3.3.8-2
- 3.3.8-2.1
- 3.3.8-2.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
jruby Ubuntu:Pro:14.04:LTS
- Versions
- 1.5.6-5ubuntu1
- 1.5.6-6
- 1.5.6-7
- 1.5.6-9+deb8u2build0.14.04.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby2.3 Ubuntu:Pro:16.04:LTS
- Versions
- 2.3.0-1
- 2.3.0-2
- 2.3.0-4ubuntu2
- 2.3.0-4ubuntu3
- 2.3.0-5ubuntu1
- 2.3.1-2~16.04
- 2.3.1-2~16.04.2
- 2.3.1-2~16.04.4
- 2.3.1-2~16.04.5
- 2.3.1-2~16.04.6
- 2.3.1-2~16.04.7
- 2.3.1-2~16.04.9
- 2.3.1-2~16.04.10
- 2.3.1-2~16.04.11
- 2.3.1-2~16.04.12
- 2.3.1-2~ubuntu16.04.13
- 2.3.1-2~ubuntu16.04.14
- 2.3.1-2~ubuntu16.04.15
- 2.3.1-2~ubuntu16.04.16
- 2.3.1-2~ubuntu16.04.16+esm1
- 2.3.1-2~ubuntu16.04.16+esm2
- 2.3.1-2~ubuntu16.04.16+esm3
- 2.3.1-2~ubuntu16.04.16+esm4
- 2.3.1-2~ubuntu16.04.16+esm5
- 2.3.1-2~ubuntu16.04.16+esm6
- 2.3.1-2~ubuntu16.04.16+esm7
- 2.3.1-2~ubuntu16.04.16+esm8
- 2.3.1-2~ubuntu16.04.16+esm9
- 2.3.1-2~ubuntu16.04.16+esm10
- 2.3.1-2~ubuntu16.04.16+esm11
- 2.3.1-2~ubuntu16.04.16+esm12
- Affected ranges
- ECOSYSTEM: < 2.3.1-2~ubuntu16.04.16+esm14
Update to 2.3.1-2~ubuntu16.04.16+esm14
jruby Ubuntu:16.04:LTS
- Versions
- 1.7.21-2ubuntu4
- 1.7.22-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby2.5 Ubuntu:Pro:18.04:LTS
- Versions
- 2.5.0~preview1-1ubuntu2
- 2.5.0-4ubuntu1
- 2.5.0-4ubuntu4
- 2.5.0-5ubuntu1
- 2.5.0-6ubuntu1
- 2.5.1-1ubuntu1
- 2.5.1-1ubuntu1.1
- 2.5.1-1ubuntu1.2
- 2.5.1-1ubuntu1.4
- 2.5.1-1ubuntu1.5
- 2.5.1-1ubuntu1.6
- 2.5.1-1ubuntu1.7
- 2.5.1-1ubuntu1.8
- 2.5.1-1ubuntu1.9
- 2.5.1-1ubuntu1.10
- 2.5.1-1ubuntu1.11
- 2.5.1-1ubuntu1.12
- 2.5.1-1ubuntu1.13
- 2.5.1-1ubuntu1.14
- 2.5.1-1ubuntu1.15
- 2.5.1-1ubuntu1.16
- 2.5.1-1ubuntu1.16+esm1
- 2.5.1-1ubuntu1.16+esm3
- 2.5.1-1ubuntu1.16+esm4
- 2.5.1-1ubuntu1.16+esm5
- 2.5.1-1ubuntu1.16+esm6
- 2.5.1-1ubuntu1.16+esm7
- Affected ranges
- ECOSYSTEM: < 2.5.1-1ubuntu1.16+esm8
Update to 2.5.1-1ubuntu1.16+esm8
jruby Ubuntu:18.04:LTS
- Versions
- 9.1.13.0-1
- 9.1.17.0-1~18.04
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby2.7 Ubuntu:Pro:20.04:LTS
- Versions
- 2.7.0-1
- 2.7.0-2
- 2.7.0-3
- 2.7.0-4
- 2.7.0-4ubuntu1
- 2.7.0-5ubuntu1
- 2.7.0-5ubuntu1.1
- 2.7.0-5ubuntu1.2
- 2.7.0-5ubuntu1.3
- 2.7.0-5ubuntu1.4
- 2.7.0-5ubuntu1.5
- 2.7.0-5ubuntu1.6
- 2.7.0-5ubuntu1.7
- 2.7.0-5ubuntu1.8
- 2.7.0-5ubuntu1.9
- 2.7.0-5ubuntu1.10
- 2.7.0-5ubuntu1.11
- 2.7.0-5ubuntu1.12
- 2.7.0-5ubuntu1.13
- 2.7.0-5ubuntu1.14
- 2.7.0-5ubuntu1.15
- 2.7.0-5ubuntu1.16
- 2.7.0-5ubuntu1.17
- 2.7.0-5ubuntu1.18
- 2.7.0-5ubuntu1.18+esm1
- 2.7.0-5ubuntu1.18+esm3
- 2.7.0-5ubuntu1.18+esm4
- Affected ranges
- ECOSYSTEM: < 2.7.0-5ubuntu1.18+esm5
Update to 2.7.0-5ubuntu1.18+esm5
jruby Ubuntu:20.04:LTS
- Versions
- 9.1.17.0-3
- 9.1.17.0-3build5
- 9.1.17.0-3build6
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby3.0 Ubuntu:22.04:LTS
- Versions
- 3.0.2-5ubuntu1
- 3.0.2-7
- 3.0.2-7ubuntu2
- 3.0.2-7ubuntu2.1
- 3.0.2-7ubuntu2.2
- 3.0.2-7ubuntu2.3
- 3.0.2-7ubuntu2.4
- 3.0.2-7ubuntu2.5
- 3.0.2-7ubuntu2.6
- 3.0.2-7ubuntu2.7
- 3.0.2-7ubuntu2.8
- 3.0.2-7ubuntu2.10
- 3.0.2-7ubuntu2.11
- 3.0.2-7ubuntu2.12
- Affected ranges
- ECOSYSTEM: < 3.0.2-7ubuntu2.13
Update to 3.0.2-7ubuntu2.13
jruby Ubuntu:24.04:LTS
- Versions
- 9.3.9.0+ds-1
- 9.4.5.0+ds-1
- 9.4.5.0+ds-1ubuntu1
- 9.4.6.0+ds-1ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby3.2 Ubuntu:24.04:LTS
- Versions
- 3.2.3-1
- 3.2.3-1build2
- 3.2.3-1build3
- 3.2.3-1ubuntu0.24.04.1
- 3.2.3-1ubuntu0.24.04.3
- 3.2.3-1ubuntu0.24.04.5
- 3.2.3-1ubuntu0.24.04.6
- 3.2.3-1ubuntu0.24.04.7
- Affected ranges
- ECOSYSTEM: < 3.2.3-1ubuntu0.24.04.8
Update to 3.2.3-1ubuntu0.24.04.8
jruby Ubuntu:25.10
- Versions
- 9.4.8.0+ds-2ubuntu1
- 9.4.8.0+ds-3ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby3.3 Ubuntu:25.10
- Versions
- 3.3.7-1ubuntu2
- 3.3.8-2ubuntu1
- 3.3.8-2ubuntu2
- 3.3.8-2ubuntu2.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
jruby Ubuntu:26.10
- Versions
- 9.4.8.0+ds-3ubuntu1
- 9.4.14.0+ds-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
jruby Ubuntu:26.04:LTS
- Versions
- 9.4.8.0+ds-3ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby3.3 Ubuntu:26.04:LTS
- Versions
- 3.3.8-2ubuntu2
- 3.3.8-2ubuntu3
- Affected ranges
- ECOSYSTEM: < 3.3.8-2ubuntu3.1
Update to 3.3.8-2ubuntu3.1
Original sources
- https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp
- https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618
- https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e
- https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c
- https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da
- https://github.com/ruby/net-imap/releases/tag/v0.3.10
- https://github.com/ruby/net-imap/releases/tag/v0.4.24
- https://github.com/ruby/net-imap/releases/tag/v0.5.14
- https://access.redhat.com/security/cve/CVE-2026-42246
- https://bugzilla.redhat.com/show_bug.cgi?id=2468499
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42246.json
- https://access.redhat.com/errata/RHSA-2026:37397
- https://access.redhat.com/errata/RHSA-2026:35895
- https://access.redhat.com/errata/RHSA-2026:33565
- https://access.redhat.com/errata/RHSA-2026:33540
- https://access.redhat.com/errata/RHSA-2026:33514
- https://access.redhat.com/errata/RHSA-2026:33515
- https://access.redhat.com/errata/RHSA-2026:35866
- https://access.redhat.com/errata/RHSA-2026:35867
- https://access.redhat.com/errata/RHSA-2026:34076
- https://access.redhat.com/errata/RHSA-2026:35834
- https://access.redhat.com/errata/RHSA-2026:33630
- https://access.redhat.com/errata/RHSA-2026:36099
- https://nvd.nist.gov/vuln/detail/CVE-2026-42246