CVE-2026-42246: 
Ruby vulnerability analysis and mitigation

CVE-2026-42246 is a STARTTLS stripping vulnerability in Ruby's Net::IMAP library that allows a man-in-the-middle (MitM) attacker to cause Net::IMAP#starttls to return successfully without actually establishing a TLS session. Disclosed on April 24, 2026, it affects net-imap versions prior to 0.3.10, 0.4.24, 0.5.14, and 0.6.4. The vulnerability carries a CVSS v3.1 base score of 7.4 (High) and a CVSS v4.0 base score of 7.6 (High) (GitHub Advisory).

The root cause lies in a race condition in the Net::IMAP#starttls command flow, classified under CWE-392 (Missing Report of Error Condition), CWE-393 (Return of Wrong Status Code), CWE-636 (Failing Open), CWE-754 (Improper Check for Exceptional Conditions), and CWE-841 (Improper Enforcement of Behavioral Workflow). A MitM attacker can inject a tagged OK response with an easily predictable IMAP tag before the client finishes sending the STARTTLS command, causing the command to complete "successfully" before the response handler is registered. As a result, the #starttls method returns without error, but the TLS handshake is never initiated and the socket remains in plaintext. The fix introduces a handled flag and a guard_against_tagged_response_skipping_handler! method that raises InvalidResponseError and disconnects if a tagged OK is received before the handler is registered (GitHub Advisory, Patch Commit).

Successful exploitation results in a TLS bypass, leaving the IMAP connection in cleartext after the client believes encryption is active. This exposes all subsequent IMAP traffic — including authentication credentials (usernames and passwords), email content, and session tokens — to interception by the MitM attacker. Both confidentiality and integrity of transmitted data are severely compromised, though availability is not directly affected (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the time of this report. The EPSS score is approximately 0.05%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a network-level MitM position between the Ruby client and the IMAP server, and the attacker must be able to inject responses with predictable IMAP tags before the client completes sending the STARTTLS command — a condition that requires precise timing (GitHub Advisory, Feedly).

1. Gain MitM position: Position the attacker between the Ruby Net::IMAP client and the target IMAP server, e.g., via ARP spoofing, DNS poisoning, or a rogue network access point on the same network segment.
2. Intercept the STARTTLS command: Monitor the plaintext IMAP connection for the client initiating a STARTTLS command. The IMAP tag used by Ruby's net-imap is predictable (e.g., RUBY0001).
3. Inject a premature tagged OK response: Before the client finishes transmitting the STARTTLS command (i.e., before the CRLF is sent), inject a forged tagged response such as `RUBY0001 OK hahaha, fooled you!

into the TCP stream toward the client. 4. **Bypass the response handler**: Because theOKresponse arrives before the client registers its response handler, the handler is never invoked, TLS is never started, and#starttls` returns without error. 5. Intercept cleartext traffic: With the socket remaining unencrypted, passively capture all subsequent IMAP traffic including login credentials and email data (GitHub Advisory, Patch Commit).

• Network: Unexpected plaintext IMAP traffic (port 143) continuing after a STARTTLS command exchange; absence of TLS handshake packets (Client Hello) following a STARTTLS sequence; anomalous TCP injection or duplicate ACK patterns around the STARTTLS command.
• Logs: Application logs showing Net::IMAP::InvalidResponseError with messages such as "STARTTLS handler was bypassed" or "Received tagged 'OK' to incomplete STARTTLS command" — these indicate the patched library detected an attempted attack.
• Application Behavior: Ruby applications using net-imap reporting unexpected disconnections immediately after calling #starttls; Net::IMAP#tls_verified? returning false after a #starttls call that did not raise an exception (on unpatched versions).

Upgrade net-imap to one of the patched versions: 0.3.10, 0.4.24, 0.5.14, or 0.6.4, which raise an InvalidResponseError and disconnect whenever #starttls does not successfully establish TLS. As a workaround on unpatched versions, explicitly check Net::IMAP#tls_verified? after calling #starttls and abort the connection if it returns false. The strongly recommended long-term mitigation is to connect directly to an implicit TLS port (IMAPS, port 993) rather than using STARTTLS on a cleartext port, as advised by RFC 8314 (GitHub Advisory). Downstream consumers such as Puppet Core 8.19 and PDK 3.7 have also released updates incorporating the patched gem (Puppet Release Notes).

The vulnerability was reported by researcher Masamuneee and patched by the net-imap maintainer (nevans) on April 24, 2026. The advisory was picked up by downstream vendors including Amazon Linux 2023 (ALAS2023-2026-1806), Puppet (Core 8.19 / PDK 3.7), Chainguard, and Wolfi, all of which issued updated packages. Security community discussion was noted on Bluesky and Mastodon/infosec.exchange, and a technical write-up was published at infinitsec.net covering the STARTTLS stripping mechanism (GitHub Advisory, Puppet Blog, Infinitsec).