CVE-2026-42245: net-imap Quadratic Complexity Vulnerability in Response Handling
Summary
CVE-2026-42245: net-imap has quadratic complexity when reading response literals. Affects net-imap across 3 version ranges.
< 0.4.24
>= 0.5.0, < 0.5.14
>= 0.6.0, < 0.6.4
Fixed in 0.4.24, 0.5.14 or 0.6.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net-imap package is a Ruby library that provides an interface for interacting with Internet Message Access Protocol (IMAP) servers. It allows users to manage and retrieve emails from their mail servers efficiently. However, the package has a vulnerability that can lead to performance degradation under certain conditions, specifically when handling large responses with multiple string literals.
Vulnerability Detail
The vulnerability arises from the way the Net::IMAP::ResponseReader processes responses from the server. When reading large responses containing numerous string literals, the ResponseReader rescans the entire response buffer for each literal, resulting in quadratic time complexity (O(n²)). This inefficiency can be exploited by a malicious server to send crafted responses that consume excessive CPU resources, leading to a denial of service (DoS) attack. The vulnerability bypasses the max_response_size protection, allowing responses to remain under the size limit while still causing significant CPU strain.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.4.240.4.24gem install net-imap -v 0.4.24 -
>= 0.5.0, < 0.5.140.5.14gem install net-imap -v 0.5.14 -
>= 0.6.0, < 0.6.40.6.4gem install net-imap -v 0.6.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users are advised to avoid connecting to untrusted IMAP servers. Additionally, setting a much smaller max_response_size (e.g., 8KiB) can limit the impact of the vulnerability. This can be done by configuring the IMAP client settings accordingly.
Conclusion
The CVE-2026-42245 vulnerability in the net-imap package poses a significant risk by allowing denial of service attacks through inefficient response handling. Users are encouraged to upgrade to the patched versions of the package and implement workarounds to mitigate potential impacts.
See every vulnerability recorded for net-imap →
FAQ
CVE-2026-42245 is a vulnerability in the net-imap Ruby library that allows for denial of service attacks due to quadratic complexity when processing large responses.
If your application uses the net-imap library and connects to untrusted IMAP servers, it may be susceptible to performance degradation and potential denial of service due to excessive CPU usage.
Affected versions include net-imap versions 0.6.3 and earlier, 0.5.13 and earlier, and 0.4.23 and earlier.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground without signup to test your application.
If an immediate upgrade is not possible, consider implementing the suggested workaround of limiting the max_response_size and avoiding connections to untrusted servers.
References
Related vulnerabilities
Recent vulnerabilities recorded for net-imap.
