CVE-2026-42245
Description
A flaw was found in Net::IMAP, a Ruby library implementing the Internet Message Access Protocol (IMAP) client functionality. A hostile server can exploit a quadratic time complexity issue in the Net::IMAP::ResponseReader when processing large responses containing numerous string literals. This can lead to the client's CPU being exhausted, resulting in a denial of service (DoS) attack.
Statement
Red Hat has rated this flaw as Moderate because a malicious IMAP server can trigger excessive CPU consumption, resulting in a denial-of-service (DoS) condition in client applications using the affected Net::IMAP library. Successful exploitation requires interaction with a hostile server, and the impact is strictly limited to resource exhaustion of the client process. The vulnerability does not allow code execution, privilege escalation, or unauthorized access to data.
Regarding Red Hat Satellite: the Satellite-shipped puppet-agent package may include Net::IMAP / net-imap files under /opt/puppetlabs as part of the bundled Puppet Ruby runtime. Satellite does not use Net::IMAP for its supported email notification functionality (SMTP is used instead), and the vulnerable IMAP client operations are not exercised on a supported Satellite attack path. Presence of these files in puppet-agent therefore does not change the assessment that these CVEs are not applicable to Red Hat Satellite. Scanner findings based solely on on-disk gem presence should be treated as false positives for Satellite product impact.
Mitigation
To reduce the risk of a denial of service, ensure that applications using the Net::IMAP library are configured to connect exclusively to trusted IMAP servers. Avoid connecting to untrusted or unverified IMAP services, as a hostile server can exploit this vulnerability. This operational control helps prevent exposure to malicious IMAP response processing.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | 7.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | Required | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
