Net::IMAP: Denial of Service via incomplete raw argument validation

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

2.1 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N · score source

EPSS

• CVE-2026-47241: 0.38% estimated exploitation activity in the next 30 days; percentile 32.28 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary Several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and then sent verbatim. If this string is derived from user-controlled input, an attacker can force the next command to be absorbed as a continuation of the first command. This will cause the first command to eventually fail, but also prevents it from returning until another command is sent (from another thread). That other command will not return until the connection is closed. Details Net::IMAP::RawData was hardened in v0.6.4, v0.5.14, and v0.4.24 to reject string arguments that would smuggle an invalid literal-continuation marker onto the wire (CVE-2026-42257, GHSA-hm49-wcqc-g2xg). But the trailing-marker check uses an incorrect regex which does not match {0} or {0+}, so an attacker-controlled seach criteria or fetch attr string ending in {0} or {0+} passes validation and is sent verbatim. Since these arguments are sent as the last argument in the command, they will be…

Published by the source

9 Jun 2026, 18:36 UTC

Last modified by the source

6 Jul 2026, 22:53 UTC

Source last checked

26 Oct 2026, 15:52 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-c4fp-cxrr-mj66

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-47241

Advisory: Net::IMAP: Denial of Service via incomplete raw argument validation
IDs: CVE-2026-47241, GHSA-c4fp-cxrr-mj66
Record: https://patchnext.com/advisories/cve-2026-47241 (revision 1, source checked 26 Oct 2026, 15:52 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Low (CVSS 2.1)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: net-imap 0.6.4.1, 0.5.15. A vendor fix does not mean a deployment is fixed.

## Affected components
- RubyGems net-imap: affected >= 0.6.0, <= 0.6.4; <= 0.5.14; fixed in 0.6.4.1, 0.5.15

## Suggested inspection (read-only)
- RubyGems net-imap: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on net-imap.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-c4fp-cxrr-mj66 (GitHub-reviewed advisory GHSA-c4fp-cxrr-mj66 lists affected ranges: RubyGems net-imap >=0.6.0 =0 <=0.5.14)

Commands are suggestions: review each one before running it.