ruby net-imap
10 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-47242 | >= 0.6.0, < 0.6.4.1 ; < 0.5.15 | Net::IMAP: Command Injection via ID command argument | MEDIUM 5.8 | 0.2 % | ||
| CVE-2026-47240 | >= 0.6.0, < 0.6.4.1 ; < 0.5.15 | Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument | MEDIUM 5.8 | 0.8 % | ||
| CVE-2026-47241 | >= 0.6.0, < 0.6.4.1 ; < 0.5.15 | Net::IMAP: Denial of Service via incomplete raw argument validation | LOW 2.1 | 0.4 % | ||
| CVE-2026-42258 | < 0.4.24 ; >= 0.5.0, < 0.5.14 ; >= 0.6.0, < 0.6.4 | net-imap: Command Injection via unvalidated Symbol inputs | MEDIUM 5.8 | 0.8 % | ||
| CVE-2026-42257 | < 0.4.24 ; >= 0.5.0, < 0.5.14 ; >= 0.6.0, < 0.6.4 | net-imap: Command Injection via "raw" arguments to multiple commands | MEDIUM 5.8 | 0.4 % | ||
| CVE-2026-42256 | >= 0.4.0, < 0.4.24 ; >= 0.5.0, < 0.5.14 ; >= 0.6.0, < 0.6.4 | net-imap: Denial of service via high iteration count for `SCRAM-*` authentication | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-42245 | < 0.4.24 ; >= 0.5.0, < 0.5.14 ; >= 0.6.0, < 0.6.4 | net-imap: Quadratic complexity when reading response literals | LOW 2.3 | 0.4 % | ||
| CVE-2026-42246 | < 0.3.10 ; >= 0.4.0, < 0.4.24 ; >= 0.5.0, < 0.5.14 ; … | net-imap vulnerable to STARTTLS stripping via invalid response timing | HIGH 7.6 | 0.3 % | ||
| CVE-2025-43857 | >= 0.5.0, < 0.5.7 ; >= 0.4.0, < 0.4.20 ; >= 0.3.0, < 0.3.9 ; … | net-imap rubygem vulnerable to possible DoS by memory exhaustion | MEDIUM 6.0 | 0.5 % | ||
| CVE-2025-25186 | >= 0.3.2, < 0.3.8 ; >= 0.4.0, < 0.4.19 ; >= 0.5.0, < 0.5.6 | Net::IMAP vulnerable to possible DoS by memory exhaustion | MEDIUM 6.5 | 0.6 % |