ruby net-imap up to 0.5.14 Net::IMAP trailing special elements

Summaryinfo

A vulnerability classified as problematic was found in ruby net-imap up to 0.5.14. This affects the function Net::IMAP. The manipulation results in improper neutralization of trailing special elements. This vulnerability is reported as CVE-2026-47241. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in ruby net-imap up to 0.5.14. Affected is the function Net::IMAP. The manipulation with an unknown input leads to a improper neutralization of trailing special elements vulnerability. CWE is classifying the issue as CWE-162. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes trailing special elements that could be interpreted in unexpected ways when they are sent to a downstream component. This is going to have an impact on availability. CVE summarizes:

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and then sent verbatim. If this string is derived from user-controlled input, an attacker can force the next command to be absorbed as a continuation of the first command. This will cause the first command to eventually fail, but also prevents it from returning until another command is sent (from another thread). That other command will not return until the connection is closed. This vulnerability is fixed in 0.6.5 and 0.5.15.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-47241 since 05/19/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 0.5.15 or 0.6.4.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Programming Language Software

Vendor

• ruby

Name

• net-imap

Version

• 0.5.0
• 0.5.1
• 0.5.2
• 0.5.3
• 0.5.4
• 0.5.5
• 0.5.6
• 0.5.7
• 0.5.8
• 0.5.9
• 0.5.10
• 0.5.11
• 0.5.12
• 0.5.13
• 0.5.14

License

• open-source

Website

• Product: https://github.com/ruby/net-imap/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion