CVE-2026-42257: 
Ruby vulnerability analysis and mitigation

CVE-2026-42257 is a CRLF/command injection vulnerability in Ruby's Net::IMAP library, where several commands accept raw string arguments that are transmitted to the IMAP server without validation or escaping. If these arguments are derived from user-controlled input, an attacker can embed CRLF sequences to inject arbitrary IMAP commands. Affected versions include all releases prior to 0.4.24, 0.5.0–0.5.13, and 0.6.0–0.6.3. The advisory was published on April 24, 2026, with patches released the same day. The CVSS v3.1 base score is 9.8 (Critical) per Feedly/NVD data, while the official GitHub advisory assigns a CVSS v4.0 score of 5.8 (Moderate) (GitHub Advisory).

The root cause is improper neutralization of CRLF sequences (CWE-93) and command injection (CWE-77) in Net::IMAP's handling of certain method arguments. Specifically, the methods #search, #uid_search, #fetch, #uid_fetch, #store, #uid_store, and #setquota pass certain String arguments directly as Net::IMAP::RawData, bypassing the library's normal argument validation and encoding pipeline that would otherwise safely encode values as IMAP atoms, quoted strings, or literals. An attacker who can influence these string arguments (e.g., via a web application that builds IMAP search queries or fetch attributes from user input) can inject \r\n sequences followed by arbitrary IMAP commands, effectively splitting the command stream sent to the server. The #store/#uid_store and #setquota methods are particularly notable because use of raw data for their arguments was both unnecessary and undocumented as a risk (GitHub Advisory).

Successful exploitation allows an attacker to inject and execute arbitrary IMAP commands on the mail server in the context of the authenticated session. While direct data exfiltration is not the primary vector, injected commands could delete mailboxes (e.g., DELETE mailbox), modify message flags, or manipulate shared mail folders accessible to the compromised account. Applications that dynamically build IMAP search queries or fetch attributes from user input — such as mail clients, archival tools, or webmail backends — are at significant risk, and the attack surface is broader for #search/#fetch than for #setquota, which is typically restricted to administrative users (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.021% (0.000210), indicating a low current probability of exploitation in the wild. The vulnerability was reported by researcher manunio and disclosed responsibly through GitHub's security advisory process (GitHub Advisory).

1. Identify a vulnerable application: Locate a Ruby application that uses Net::IMAP versions prior to 0.4.24, 0.5.14, or 0.6.4 and passes user-controlled input to #search, #uid_search, #fetch, #uid_fetch, #store, #uid_store, or #setquota as a raw String argument.
2. Craft a malicious input: Construct a string containing a CRLF sequence (\r\n) followed by an arbitrary IMAP command. For example, a search criteria string like ALL\r\nA002 DELETE INBOX would terminate the current command and inject a DELETE INBOX command.
3. Deliver the payload: Submit the crafted input through the application's interface (e.g., a search field in a webmail client, an API parameter, or a form that triggers an IMAP operation).
4. Command injection executes: The Net::IMAP library passes the raw string directly to the IMAP socket without sanitization. The IMAP server receives and processes the injected command in the context of the authenticated session.
5. Achieve objective: Depending on the injected command and the authenticated user's privileges, the attacker can delete mailboxes, alter message flags, access shared folders, or perform other IMAP operations permitted by the session (GitHub Advisory).

• Network: IMAP traffic containing unexpected \r\n sequences mid-command in arguments to SEARCH, FETCH, STORE, or SETQUOTA commands; multiple IMAP commands appearing within a single expected command exchange.
• Logs: IMAP server logs showing unexpected command sequences (e.g., DELETE, RENAME, STORE commands) immediately following SEARCH or FETCH commands from the same session; anomalous command sequences not matching normal application behavior.
• Application Logs: Ruby application errors or unexpected IMAP server responses (e.g., BAD or NO responses) when processing user-supplied search or fetch parameters, which may indicate failed injection attempts.

Upgrade net-imap to one of the patched versions: 0.4.24, 0.5.14, or 0.6.4, released on April 23, 2026. The patches validate that Net::IMAP::RawData contains only well-formed IMAP text with no unescaped NULL, CR, or LF bytes, and remove the use of RawData for #store, #uid_store, and #setquota entirely. If an immediate upgrade is not possible, validate all string inputs to the affected methods by checking for \r and \n characters before passing them to Net::IMAP; prefer passing search criteria as arrays of key-value pairs rather than interpolated strings; and use Kernel#Integer to coerce and validate inputs to #setquota's limit argument (GitHub Advisory, v0.6.4 Release).

Puppet announced security updates to Puppet Core 8.19 and PDK 3.7 that include the patched net-imap dependency, indicating downstream ecosystem uptake of the fix. Amazon Linux 2023 also issued a security advisory (ALAS2023-2026-1807) addressing this CVE. The vulnerability was detected by Nessus and Qualys scanners shortly after disclosure, and RubySec published an advisory entry. Community discussion was limited, with no significant controversy or notable researcher commentary beyond the responsible disclosure process (Puppet Blog, RubySec).