Two vulnerabilities in Ruby require patching: CVE-2026-42258 (CVSS 5.3 MEDIUM) allows a malicious IMAP server to inject arbitrary commands via CRLF sequences in Net::IMAP, affecting ruby-lang net versions <0.4.24, >=0.5.0 <0.5.14, and >=0.6.0 <0.6.4, fixed in versions 0.4.24, 0.5.14, and 0.6.4 respectively; and CVE-2026-27820 (CVSS 9.8 CRITICAL) is a buffer overflow in Zlib::GzipReader that can lead to memory corruption and code execution via a crafted gzip stream, affecting ruby-lang zlib versions <3.0.1, >=3.1.0 <3.1.2, and >=3.2.0 <3.2.3, fixed in versions 3.0.1, 3.1.2, and 3.2.3.
It was discovered that the Net::IMAP client in Ruby did not properly sanitize Symbol arguments passed to IMAP commands. A remote attacker controlling a malicious IMAP server, or able to influence command arguments, could use this to inject arbitrary IMAP commands via CRLF sequences. (CVE-2026-42258) It was discovered that the Zlib::GzipReader in Ruby did not correctly ensure sufficient buffer capacity in the zstream_buffer_ungets function. An attacker could use this to craft a gzip stream that, when processed, could cause a buffer overflow, resulting in memory corruption and possibly arbitrary code execution. (CVE-2026-27820)