Two critical vulnerabilities in Ruby's Net::IMAP library allow for TLS downgrade attacks (CVE-2026-42246, CVSS 7.4 HIGH) and arbitrary command injection (CVE-2026-42257, CVSS 9.8 CRITICAL). Affected versions are ruby-lang net\ < 0.3.10, 0.4.0 to < 0.4.24, 0.5.0 to < 0.5.14, and 0.6.0 to < 0.6.4. Remediation requires upgrading to the patched versions 0.3.10, 0.4.24, 0.5.14, or 0.6.4, respectively.
It was discovered that Ruby's Net::IMAP library did not properly verify that Transport Layer Security (TLS) encryption was started after issuing a STARTTLS command. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack and silently bypass TLS encryption. (CVE-2026-42246) It was also discovered that Ruby's Net::IMAP library did not validate string arguments passed to certain commands. A remote attacker could possibly use this issue to inject arbitrary IMAP commands. (CVE-2026-42257)