This Important Red Hat security update addresses three vulnerabilities in the `net-imap` Ruby gem: a Denial of Service via crafted IMAP responses (CVE-2026-42245, CVSS 7.5 HIGH), an IMAP Command Injection via Symbol Arguments (CVE-2026-42258, CVSS 5.3 MEDIUM), and an Information Disclosure via MITM attack bypassing TLS (CVE-2026-42246, CVSS 7.4 HIGH). Affected versions are `net-imap` < 0.3.10, >= 0.4.0 < 0.4.24, >= 0.5.0 < 0.5.14, and >= 0.6.0 < 0.6.4. The fixed versions are 0.3.10, 0.4.24, 0.5.14, and 0.6.4, respectively.
Red Hat Product Errata RHSA-2026:35895 - Security Advisory Issued: 2026-07-06 Updated: 2026-07-06 RHSA-2026:35895 - Security Advisory Overview Updated Packages Synopsis Important: ruby security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for ruby is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245) ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.0 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.0 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64 Fixes BZ - 2468495 - CVE-2026-42245 ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses BZ - 2468498 - CVE-2026-42258 ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments BZ - 2468499 - CVE-2026-42246 net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS CVEs CVE-2026-42245 CVE-2026-42246 CVE-2026-42258 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 SRPM ruby-3.3.10-11.el10_0.2.src.rpm SHA-256: 2b6ff8a22c2f07d3d9117c04b11291032d9b1412aeb707b318c5cfc9f7ad8b29 x86_64 ruby-3.3.10-11.el10_0.2.x86_64.rpm SHA-256: b9b69ec390d9669819df6af4f03a3528ebfbcb6c818687a44190784bb8f71289 ruby-bundled-gems-3.3.10-11.el10_0.2.x86_64.rpm SHA-256: aa850b9be07e0919cde24990c6501b8136a1504c2cfd77c4e46cc5261d390fcc ruby-bundled-gems-debuginfo-3.3.10-11.el10_0.2.x86_64.rpm SHA-256: 9bc3ab0206bd07b1df6cbf7bc4bdc7f0ab19eb3073d7863045d4466b73aefca6 ruby-debuginfo-3.3.10-11.el10_0.2.x86_64.rpm SHA-256: d7412a7f4c884420e78551ac1b06b1e8d0417898bad52d64d27a0c8e8699e0a8 ruby-debugsource-3.3.10-11.el10_0.2.x86_64.rpm SHA-256: 1c9c712c35adca02a7a122277ddeb2a7033aa8d7d7beb1a0c4b3f3cbf5c2794d ruby-default-gems-3.3.10-11.el10_0.2.noarch.rpm SHA-256: 81bb58e6ed49d2f3f2bbf9b10dd9e05e30ac931a9f74f16c5c8dc1565cc27eba ruby-devel-3.3.10-11.el10_0.2.x86_64.rpm SHA-256: 4c996e8bfc93f186b073dfe217ff0650464674a01edda9e54da78aad77041720 ruby-libs-3.3.10-11.el10_0.2.x86_64.rpm SHA-256: b32291195be884a32469ad3c33478b73f29cad93c499d10ec32597dd8656875b ruby-libs-debuginfo-3.3.10-11.el10_0.2.x86_64.rpm SHA-256: 7d07f0f822e0a52a3a439f2077fc428bb4ec7bd8fc53f83eba08d68c630dc728 rubygem-bigdecimal-3.1.5-11.el10_0.2.x86_64.rpm SHA-256: 1c8afa4f624496cc29a30032f032cbf0b93f34d55d51f33a51d4c51ca352b381 rubygem-bigdecimal-debuginfo-3.1.5-11.el10_0.2.x86_64.rpm SHA-256: 89ee4975851476e7b82b9cac915e9b8537711fc125f62d356bbfba4069f31824 rubygem-bundler-2.5.22-11.el10_0.2.noarch.rpm SHA-256: 5319ed260ce5c8c84e63afdd55dc3afda3a5bec0d02075f95228488a940e0175 rubygem-io-console-0.7.1-11.el10_0.2.x86_64.rpm SHA-256: f2a7162fbcc50db2175b526c632229da2a543599cc9c1a5219b3be58f53ed729 rubygem-io-console-debuginfo-0.7.1-11.el10_0.2.x86_64.rpm SHA-256: 28644ac4364e214f2a03d09c6398d684e2ad4922d87ca2d96abae2585ea853a4 rubygem-irb-1.13.1-11.el10_0.2.noarch.rpm SHA-256: 549f6e9194dfc67327c28d81099104ee9a6fd0cd52e283548c90fa6f08232a86 rubygem-json-2.7.2-11.el10_0.2.x86_64.rpm SHA-256: c1896ec498c20797fed5e6e1ef9f4a3dcd71755ecf1fd05afa88bc4e14f4647e rubygem-json-debuginfo-2.7.2-11.el10_0.2.x86_64.rpm SHA-256: 691fb376b8c805ff8a66e23979839b15b4141b76fedc628f1ae78944304aa001 rubygem-minitest-5.20.0-11.el10_0.2.noarch.rpm SHA-256: 1e136e2455b4b87db01cdb4c7a378031814d9ed144eb8619404edbd5e293784a rubygem-power_assert-2.0.3-11.el10_0.2.noarch.rpm SHA-256: 918d61f66d6567c52131fa039d75dc7c98dc52578aba7ff9c8d4248f82e003e2 rubygem-psych-5.1.2-11.el10_0.2.x86_64.rpm SHA-256: cb7405f330e7ce73055e3c5784ff0478c2c73cd936350834c1bd25292703765e rubygem-psych-debuginfo-5.1.2-11.el10_0.2.x86_64.rpm SHA-256: 66ed1392de401d1ca8c8fdcc98675ea68ef5c5c15300d676b99449fa7daaefd9 rubygem-racc-1.7.3-11.el10_0.2.x86_64.rpm SHA-256: 634117ac0dbd96a689e03b5849f5d184092a0042f81297425827b451d69027fe rubygem-racc-debuginfo-1.7.3-11.el10_0.2.x86_64.rpm SHA-256: 074cddb615b07f54fde7f21cc928ab11b90bb071b4da181fa377b76fb7c96ce9 rubygem-rake-13.1.0-11.el10_0.2.noarch.rpm SHA-256: baf23a13b16ef14b352e58a94b03a28f333897334b568300e52bfe51ad997f40 rubygem-rbs-3.4.0-11.el10_0.2.x86_64.rpm SHA-256: 676240dabb104ea5224a90102bf9ef5f1c2314bcaa97e5a60475bea39e3451ae rubygem-rbs-debuginfo-3.4.0-11.el10_0.2.x86_64.rpm SHA-256: e4f51f1469fe12575496d1985126d495eae6ec0162db01ef682138f16a3d028d rubygem-rdoc-6.6.3.1-11.el10_0.2.noarch.rpm SHA-256: f3f6d029f22b8b9c69f00f0e357c5d7a35b99fea7072b7487c4be6ac498dbadf rubygem-rexml-3.4.4-11.el10_0.2.noarch.rpm SHA-256: 2e1a3b9f953bedacb7bd910d92c00d04c18d01b75551b171c8f49239a2ab2a7a rubygem-rss-0.3.1-11.el10_0.2.noarch.rpm SHA-256: 95ee3a44017f74db0582eb9cde4e6a11174894124349f65199c7043dae664f76 rubygem-test-unit-3.6.1-11.el10_0.2.noarch.rpm SHA-256: b01d9e2a5260caf0d57495876f22710cb0368956a5827df579571041f86bbde6 rubygem-typeprof-0.21.9-11.el10_0.2.noarch.rpm SHA-256: 08cb494a70a8e0ab64dd420a943c2942c43f3e783c23fed270f0289610ea4924 rubygems-3.5.22-11.el10_0.2.noarch.rpm SHA-256: d0d0fbbc2ed019cf2586a7bd56dcc564b17fa9cab18d815affd86065c9fe17ab rubygems-devel-3.5.22-11.el10_0.2.noarch.rpm SHA-256: 8f4039e142651b879c37868015d77296639b08d17eedb5ad65022b7d9a7fd9d9 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 SRPM ruby-3.3.10-11.el10_0.2.src.rpm SHA-256: 2b6ff8a22c2f07d3d9117c04b11291032d9b1412aeb707b318c5cfc9f7ad8b29 s390x ruby-3.3.10-11.el10_0.2.s390x.rpm SHA-256: 2aaa46feb7e974ccd6b3037b74a8e0b14e5b2556754674537a3dbe0dae30f5a0 ruby-bundled-gems-3.3.10-11.el10_0.2.s390x.rpm SHA-256: 778e16abece03c132b88f37a4995e4dd1a7b1278f642a64cd0571fea8c0d6b07 ruby-bundled-gems-debuginfo-3.3.10-11.el10_0.2.s390x.rpm SHA-256: 2471be9bb6684ca2155e3972bafe0f0f65ea84272825ff10d18ab5d31ecd05b0 ruby-debuginfo-3.3.10-11.el10_0.2.s390x.rpm SHA-256: 28b8641aaf320d431d5ea51eee55fe2e268b0758d8d2fb1583b93da213894707 ruby-debugsource-3.3.10-11.el10_0.2.s390x.rpm SHA-256: 9cf9db91358a3d2cd1c0fed39f6e3014454edcb013fee3af2646157a2f6aee09 ruby-default-gems-3.3.10-11.el10_0.2.noarch.rpm SHA-256: 81bb58e6ed49d2f3f2bbf9b10dd9e05e30ac931a9f74f16c5c8dc1565cc27eba ruby-devel-3.3.10-11.el10_0.2.s390x.rpm SHA-256: 19bdb6d780a7b9d58ba880d41e13856dc44004079df65d9c7091a01cf1f3b5ee ruby-libs-3.3.10-11.el10_0.2.s390x.rpm SHA-256: eb37a61d7de391e2daae7438d5b2cde8e37cb6b76ae816f48cbbd6d0a895f4ad ruby-libs-debuginfo-3.3.10-11.el10_0.2.s390x.rpm SHA-256: b3fa5944492189c802890d3d44b86d167666a173487776525cf3941fca5fbbd4 rubygem-bigdecimal-3.1.5-11.el10_0.2.s390x.rpm SHA-256: 5ca0b9be4fc1389233ec3667cf95a383f27c364d7b02f885db2bafafcf08f57b rubygem-bigdecimal-debuginfo-3.1.5-11.el10_0.2.s390x.rpm SHA-256: 797ff0c10a467e8ccbc526be4299a51c0d27f06b12ea8769658c499acd37d3f5 rubygem-bundler-2.5.22-11.el10_0.2.noarch.rpm SHA-256: 5319ed260ce5c8c84e63afdd55dc3afda3a5bec0d02075f95228488a940e0175 rubygem-io-console-0.7.1-11.el10_0.2.s390x.rpm SHA-256: ff5f213dcf9a7b8a33a38cf0c368515f3ec9697d4a47d84601eda5f23a9b6cea rubygem-io-console-debuginfo-0.7.1-11.el10_0.2.s390x.rpm SHA-256: 41f626b8dd5b8681c70d9d5cf830411f3b25e50f95010bb38acff6fa85f18e45 rubygem-irb-1.13.1-11.el10_0.2.noarch.rpm SHA-256: 549f6e9194dfc67327c28d81099104ee9a6fd0cd52e283548c90fa6f08232a86 rubygem-json-2.7.2-11.el10_0.2.s390x.rpm SHA-256: 1da940bb6b8590f1539fe670645503a6510ef05525e7ff03fe1daed0489a7d3d rubygem-json-debuginfo-2.7.2-11.el10_0.2.s390x.rpm SHA-256: a0b3b1f3dea6264eccc6c26cfd763b81bc49e8311f4c93ca3a4f847f3720a2f1 rubygem-minitest-5.20.0-11.el10_0.2.noarch.rpm SHA-256: 1e136e2455b4b87db01cdb4c7a378031814d9ed144eb8619404edbd5e293784a rubygem-power_assert-2.0.3-11.el10_0.2.noarch.rpm SHA-256: 918d61f66d6567c52131fa039d75dc7c98dc52578aba7ff9c8d4248f82e003e2 rubygem-psych-5.1.2-11.el10_0.2.s390x.rpm SHA-256: 4c723456cb3c80859616d27d33ed7eba89d0e667d2ba0cc7adc4e01edc7bcbe4 rubygem-psych-debuginfo-5.1.2-11.el10_0.2.s390x.rpm SHA-256: dded59cf5cf9ae3ffee329ce608cbae6edee91c24b752271ad06220b43788b3c rubygem-racc-1.