HarborGuard / CVE
Back to search
HIGHCVE-2026-42246Published Modified CNA GitHub_M

CVE-2026-42246: net-imap vulnerable to STARTTLS stripping via invalid response timing

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.

Metrics

CVSS v4.0
7.6
Severity
HIGH
Fixed in
—
Affected Products
1
Affected packages
  • ruby / net-imap
    < 0.3.10 · >= 0.4.0, < 0.4.24 · >= 0.5.0, < 0.5.14 · >= 0.6.0, < 0.6.4
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References