This security update addresses three vulnerabilities in the Ruby `net-imap` library: a high-severity denial of service via crafted IMAP responses (CVE-2026-42245, CVSS 7.5), a medium-severity command injection via symbol arguments (CVE-2026-42258, CVSS 5.3), and a high-severity information disclosure via a man-in-the-middle attack bypassing TLS (CVE-2026-42246, CVSS 7.4). The affected version ranges are `net-imap` < 0.3.10, >= 0.4.0 < 0.4.24, >= 0.5.0 < 0.5.14, and >= 0.6.0 < 0.6.4. The vulnerabilities are fixed in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.
Red Hat Product Errata RHSA-2026:36099 - Security Advisory Issued: 2026-07-07 Updated: 2026-07-07 RHSA-2026:36099 - Security Advisory Overview Updated Packages Synopsis Important: ruby:3.3 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for the ruby:3.3 module is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245) ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - AUS 9.4 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x Fixes BZ - 2468495 - CVE-2026-42245 ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses BZ - 2468498 - CVE-2026-42258 ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments BZ - 2468499 - CVE-2026-42246 net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS CVEs CVE-2026-42245 CVE-2026-42246 CVE-2026-42258 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.4 SRPM ruby-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.src.rpm SHA-256: 7c472613a1849ccf87fe8559b7267c59a8846cb363ddef5d1fa14e95ac6f99c3 rubygem-mysql2-0.5.5-1.module+el9.4.0+21222+faeeed2f.src.rpm SHA-256: 419e0ebe6f814e8e7f62662ce27d77fb3b60316c9d7e3b94d78327940a769e03 rubygem-pg-1.5.4-1.module+el9.4.0+21222+faeeed2f.src.rpm SHA-256: e8a8a2a8459b15625eecc0d993a25e825c63a761b8f55bd22b861557633a8029 x86_64 ruby-default-gems-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: 30dde3274b9c5e093514ad0247b9efeb24545bc9687a09fe57a8bebcaca43d98 ruby-doc-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: 6065ac0d02dda1c93b6c7c9c1b67da8d8c65628b612b639690d945bb82ed242f rubygem-bundler-2.5.22-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: 3eca32b4d7d7d60d23984f2efa8bd125ae16f5d632f2ef0fda4c686cb38e0508 rubygem-irb-1.13.1-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: f370fcfaadc317edc56a2e92c4abc14b1e72ef2115706ba6f06e276e7b677880 rubygem-minitest-5.20.0-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: 87b14ede88be4d2a44e11330f602b4e8ca615bf80db7067df95927c6a614b743 rubygem-mysql2-doc-0.5.5-1.module+el9.4.0+21222+faeeed2f.noarch.rpm SHA-256: 776791c4f98d288bc7f7475777aabe7665f6f34fa31f101b3345c2e69467232a rubygem-pg-doc-1.5.4-1.module+el9.4.0+21222+faeeed2f.noarch.rpm SHA-256: ff3e9f4f4ec4321b5b107c2f643f24c87f2ea1ecb6c3e560845d3cfff9538354 rubygem-power_assert-2.0.3-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: 2877abfeb15913c5f09b6ac6eaf9d429d88af58c2a374b3d9d39d6876d276f25 rubygem-rake-13.1.0-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: d47e3a6fa91753dea4098586da0c7a5e5f7299c9ec0571e805188315003029ec rubygem-rdoc-6.6.3.1-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: 6cba6feef2ec1daafbe48251d40b6c9179d9d5b64d8608dc818bc53d7b64dc67 rubygem-rexml-3.4.4-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: e283753c9e5de9ffd2d6b3294a79548a9051a970c830a125aebbdaad1c60c1c3 rubygem-rss-0.3.1-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: 842d06cbd05407455eeddb69985fb30f20754fc2cf11d46293eab1b1a3ad99a6 rubygem-test-unit-3.6.1-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: 388f06596adbc62ad3889b29c4a94951225c9357b4e4862771aff8b13fda584c rubygem-typeprof-0.21.9-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: 24dc4a654bf76047a8e2fae1296dc768a67f3a18cb04993d8b9903b1befe8ad8 rubygems-3.5.22-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: 74818b47f2601f42b7746f7eb40b0dcd4e949f0d2dd46d38ea85b402f446a112 rubygems-devel-3.5.22-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: 328d4ccf6d7ecc341a51c9245e26c6c2e97a46481e18b7e26438e04bed6fa157 ruby-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.i686.rpm SHA-256: 93d68db6b6e89887840ebd1906219cc73360b86b6fe0f7ecbe84a532d06ba781 ruby-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.x86_64.rpm SHA-256: d57485a2a1ebb2395cf3b343b61a1827048b484c115ae221592b65ddbd566030 ruby-bundled-gems-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.i686.rpm SHA-256: 200ff3c5b33e0358374a2102ba5bfe6efcee505c1713b0352f85d07dff64abe4 ruby-bundled-gems-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.x86_64.rpm SHA-256: e55ab8a401ac3e1fe8dc2ceef1396499d7f7e9f6889026d7bb483773bf599d33 ruby-bundled-gems-debuginfo-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.i686.rpm SHA-256: a7a105da63e5b3ccac3eb42dd9fc46cef0643aa2d4276a7784b1e5e570639ed3 ruby-bundled-gems-debuginfo-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.x86_64.rpm SHA-256: b08665273a604b013002c0c90a29c889e57e43678bebae54f575aa9d6761a9bf ruby-debuginfo-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.i686.rpm SHA-256: 8810e986f3fa61934e031f49897a9f8eb63b02c9f5d0eec6507cbe25afb52d5d ruby-debuginfo-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.x86_64.rpm SHA-256: 4b17363393465f3f4e2f9ebe574ebcbf3b586cd39ae6e39f206e41ea79085475 ruby-debugsource-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.i686.rpm SHA-256: 5e60aa38f604d5f825d4732e378408a58f2f49a818d3fe4493b2c36481ceedcb ruby-debugsource-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.x86_64.rpm SHA-256: 029aeea3c4c509788e9758dad931e7b7580fe99f8fd22289e50eabdfb49d83de ruby-default-gems-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: 30dde3274b9c5e093514ad0247b9efeb24545bc9687a09fe57a8bebcaca43d98 ruby-devel-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.i686.rpm SHA-256: 4ee7adc3a9f94d85170ab9e82b028abe9bc192dd149c26dafcee18691e7827a0 ruby-devel-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.x86_64.rpm SHA-256: a1b186ad65568923082bcb057fb073f2fcd75c52e9168ffdc88169647a4a9e82 ruby-doc-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: 6065ac0d02dda1c93b6c7c9c1b67da8d8c65628b612b639690d945bb82ed242f ruby-libs-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.i686.rpm SHA-256: 4ee717406d161eaafe01c5ad5e993ebae06deb959a9478490120fa07c27f35df ruby-libs-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.x86_64.rpm SHA-256: 8d3ef01b59fb401db7e16405cfcca01a651733f6a4ee4d5b2350b0bc998dc535 ruby-libs-debuginfo-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.i686.rpm SHA-256: 4b2862fab41a866c09e8ede7cb354f6967d0d8438e07ff15160f58b048804b9e ruby-libs-debuginfo-3.3.10-7.module+el9.4.0+24474+8fc4d0bd.x86_64.rpm SHA-256: 923f74f18ed1a68b5ab3d10dfe5462d89d83ba21afc825290d5120f6591103a5 rubygem-bigdecimal-3.1.5-7.module+el9.4.0+24474+8fc4d0bd.i686.rpm SHA-256: 4dd30b454d20cf7c1e79b5fcbfe24eb662caf89504ed70bf5e67eb58035eede9 rubygem-bigdecimal-3.1.5-7.module+el9.4.0+24474+8fc4d0bd.x86_64.rpm SHA-256: 7be8b2564f765f9f47f7d880e145992e5bd435e9e666f9707b6d1884bae123d9 rubygem-bigdecimal-debuginfo-3.1.5-7.module+el9.4.0+24474+8fc4d0bd.i686.rpm SHA-256: deb90fac8a54c05042d2795b1bce50a9fcc08bc69ba64c05a51f95f9d2ada3dd rubygem-bigdecimal-debuginfo-3.1.5-7.module+el9.4.0+24474+8fc4d0bd.x86_64.rpm SHA-256: aab0a2156e5865bbecb4d44484d3597b1393556a209c3b0dca0c9ea035f562a4 rubygem-bundler-2.5.22-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: 3eca32b4d7d7d60d23984f2efa8bd125ae16f5d632f2ef0fda4c686cb38e0508 rubygem-io-console-0.7.1-7.module+el9.4.0+24474+8fc4d0bd.i686.rpm SHA-256: 9ba3deaf4e6c1c6e8efd12620f7009c1b5fd9050a8e0dc336e4fe9fd09f345a1 rubygem-io-console-0.7.1-7.module+el9.4.0+24474+8fc4d0bd.x86_64.rpm SHA-256: cfcc42338d3c527075faf10d26c01bb3f234a52c2d26c9c7e12bac342bfc22a5 rubygem-io-console-debuginfo-0.7.1-7.module+el9.4.0+24474+8fc4d0bd.i686.rpm SHA-256: afe75f1d739ff8b2cb19f9c4537a91e4bc73c4898d45ed49029f7d84fe8a47c9 rubygem-io-console-debuginfo-0.7.1-7.module+el9.4.0+24474+8fc4d0bd.x86_64.rpm SHA-256: 070db8f848cc0770563433d3c2053fee63dafba0c2fc3226285554014d658260 rubygem-irb-1.13.1-7.module+el9.4.0+24474+8fc4d0bd.noarch.rpm SHA-256: f370fcfaadc317edc56a2e92c4abc14b1e72ef2115706ba6f06e276e7b677880 rubygem-json-2.7.2-7.module+el9.4.0+24474+8fc4d0bd.i686.rpm SHA-256: 68938009b9bd40a3c254cdbaa37456f095c3fe26f382e8a88feca42224c48879 rubygem-json-2.7.2-7.module+el9.4.0+24474+8fc4d0bd.x86_64.rpm SHA-256: 2eea9bddcec3f3a4f7ec281cf07c64d1fcf02bd5071fb14726155734faf7d857 rubygem-json-debuginfo-2.7.2-7.module+el9.4.0+24474+8fc4d0bd.i686.rpm SHA-256: 697ec421057cc132f285cb479524adba16319d854a5d950ed029e227134d2cef rubygem-json-debuginfo-2.7.2-7.module+el9.4.0+24474+8fc4d0bd.x86_64.rpm SHA-256: 9855af76dcec7cb4928581d9b511d032d5d1a63497d95de7918f3babf8876fbe rubygem-minite