CVE-2026-42245

216.73.217.22

· Published 09/05/2026 20:16 · Modified 09/05/2026 20:16

Labels: CVE-2026-42245 2026-05-09 CVE-2026-42245 CWE-407 [email protected]

Essential information

Published: 09/05/2026 20:16
Modified: 09/05/2026 20:16
Author: —
Creator: —
CVSS: 2.3 LOW (v3) 2.3 LOW (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

NVD status

Status: Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
ruby / net imap	`cpe:2.3:a:ruby:net_imap:<0.4.24:::::::*`
ruby / net imap	`cpe:2.3:a:ruby:net_imap:<0.5.14:::::::*`
ruby / net imap	`cpe:2.3:a:ruby:net_imap:<0.6.4:::::::*`