CVE-2026-42256: 
Ruby vulnerability analysis and mitigation

CVE-2026-42256 is a computational denial-of-service vulnerability in Ruby's Net::IMAP library affecting its SCRAM-SHA1 and SCRAM-SHA256 authentication implementation. A hostile IMAP server can send an arbitrarily large PBKDF2 iteration count in the SCRAM server-first-message, causing the client to perform an extremely expensive OpenSSL::KDF.pbkdf2_hmac computation that freezes the entire Ruby VM. Affected versions are 0.4.0–0.4.23, 0.5.0–0.5.13, and 0.6.0–0.6.3. The vulnerability was disclosed on April 24, 2026, and has a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 6.0 (Medium) (GitHub Advisory).

The root cause is twofold: CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-1322 (Use of Blocking Code in Single-threaded, Non-blocking Context). During SCRAM authentication, the client reads the server-supplied iteration count from the server-first-message and passes it directly to OpenSSL::KDF.pbkdf2_hmac without enforcing an upper bound. Because pbkdf2_hmac is a blocking C extension that holds Ruby's Global VM Lock (GVL), an inflated iteration count (up to 2³¹ − 1, the maximum 32-bit signed integer accepted by OpenSSL) can block all Ruby threads for potentially over seven minutes. Critically, Timeout and Thread.raise cannot interrupt this blocking C call, making it impossible to recover without process termination. The attack requires the client to initiate a SCRAM authentication handshake with a server under attacker control (GitHub Advisory, Patch Commit).

Successful exploitation causes a complete availability loss for the affected Ruby client process: all Ruby threads are blocked for the duration of the PBKDF2 computation, effectively freezing or crashing the application. There is no confidentiality or integrity impact — the attack is purely a denial-of-service. Applications that connect to untrusted or user-supplied IMAP servers (e.g., email clients, mail aggregators, or automation tools built on Net::IMAP) are most at risk, as a single malicious server response during authentication can render the entire Ruby process unresponsive (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.05%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to operate or control a malicious IMAP server that the victim client connects to, and the victim must initiate a SCRAM-SHA1 or SCRAM-SHA256 authentication attempt — meaning user interaction or an automated connection is a prerequisite.

1. Set up a malicious IMAP server: The attacker deploys a rogue IMAP server (e.g., using a custom script or modified open-source IMAP server) that advertises SCRAM-SHA1 or SCRAM-SHA256 as supported authentication mechanisms.
2. Lure the victim client: The attacker directs a Ruby application using Net::IMAP to connect to the malicious server — for example, by providing a crafted IMAP server address in a user-configurable field, via DNS spoofing, or through a man-in-the-middle position on an unencrypted connection.
3. Initiate SCRAM authentication: The victim client begins a SCRAM-SHA1 or SCRAM-SHA256 authentication handshake by sending a client-first-message.
4. Send inflated iteration count: The malicious server responds with a crafted server-first-message containing an extremely large i= (iteration count) parameter, such as i=2147483647 (2³¹ − 1).
5. Trigger VM freeze: The client passes this value to OpenSSL::KDF.pbkdf2_hmac, which blocks the Ruby GVL for the duration of the computation — potentially many minutes — freezing all threads in the Ruby process and causing a denial of service (GitHub Advisory).

• Process: Ruby process exhibiting sustained 100% CPU usage on a single core during an IMAP authentication phase, with no response to signals or other thread activity.
• Network: Outbound IMAP connections (TCP port 143 or 993) to unexpected or newly observed server IPs, particularly if the connection stalls indefinitely after the initial handshake.
• Logs: Application logs showing an IMAP authentication attempt that never completes or times out; absence of post-authentication log entries after a SCRAM mechanism was selected.
• Process: Child or parent Ruby processes becoming unresponsive (zombie or hung state) coinciding with IMAP connection attempts to untrusted servers.

Upgrade net-imap to version 0.4.24 (for 0.4.x), 0.5.14 (for 0.5.x), or 0.6.4 (for 0.6.x), which introduce a configurable max_iterations parameter for SCRAM authenticators (GitHub Advisory, v0.4.24 Release). Important: The default max_iterations in patched versions is still 2³¹ − 1, which provides no protection unless explicitly lowered. Users must call Net::IMAP#authenticate with a max_iterations: keyword argument set to a safe value appropriate for their hardware (e.g., a few million iterations). As a workaround prior to patching, avoid using SCRAM-SHA1 or SCRAM-SHA256 mechanisms when connecting to untrusted IMAP servers, and prefer alternative authentication mechanisms such as PLAIN over TLS.

The vulnerability was reported by security researcher Masamuneee and disclosed by the net-imap maintainer (nevans) via GitHub Security Advisories on April 24, 2026 (GitHub Advisory). The issue was also noted in the Puppet Core 8.19 and PDK 3.7 release notes as a dependency security update, indicating downstream ecosystem awareness (Puppet Blog). Amazon Linux 2023 issued a security advisory (ALAS2023-2026-1807) addressing this CVE. Community discussion has been limited, consistent with the moderate severity and lack of active exploitation.