CVE-2026-42256

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1322",
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42256.json"
}

References

Affected packages

Git / github.com/ruby/net-imap

Affected ranges

Type

GIT

Repo

https://github.com/ruby/net-imap

Events

Introduced

a9459de2c725563d27943e73a92a61f69ef9b048

Fixed

24a4e770b43230286a05aa2a9746cdbb3eb8485e

Introduced

cc13c91c65b78ee33ebf4960d547173e761cafdc

Fixed

4063bc1d1d3e21046544ed7a2c131e5f886bab01

Introduced

567518cae5500f7c4776a1fd4e9bbd599e98b9bf

Fixed

3e490673dca65d0cfeeeb3fbf1fdaa188d6f27c4

Fixed

158d0b505074397cdb5ceb58935e42dd2bcfa612

Fixed

808001bc45c06f7297a7e96d341279e041a7f7f4

Fixed

99f59eab6064955a23debd95410263ad144df758

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*",
            "range": [
                {
                    "introduced": "0.4.0"
                },
                {
                    "fixed": "0.4.24"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*",
            "range": [
                {
                    "introduced": "0.5.0"
                },
                {
                    "fixed": "0.5.14"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*",
            "range": [
                {
                    "introduced": "0.6.0"
                },
                {
                    "fixed": "0.6.4"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "158d0b505074397cdb5ceb58935e42dd2bcfa612"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "808001bc45c06f7297a7e96d341279e041a7f7f4"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "99f59eab6064955a23debd95410263ad144df758"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v0.4.24",
            "range": [
                {
                    "fixed": "24a4e770b43230286a05aa2a9746cdbb3eb8485e"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "v0.5.14",
            "range": [
                {
                    "fixed": "4063bc1d1d3e21046544ed7a2c131e5f886bab01"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "v0.6.4",
            "range": [
                {
                    "fixed": "3e490673dca65d0cfeeeb3fbf1fdaa188d6f27c4"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*

v0.4.0

v0.4.1

v0.4.10

v0.4.11

v0.4.12

v0.4.13

v0.4.14

v0.4.15

v0.4.16

v0.4.17

v0.4.18

v0.4.19

v0.4.2

v0.4.20

v0.4.21

v0.4.22

v0.4.23

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.4.7

v0.4.8

v0.4.9

v0.5.0

v0.5.1

v0.5.10

v0.5.11

v0.5.12

v0.5.13

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.8

v0.5.9

v0.6.0

v0.6.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42256.json"