CVE-2026-42256: net-imap Denial of Service via High Iteration Count in SCRAM Authentication
Summary
CVE-2026-42256: net-imap vulnerable to denial of service via high iteration count for SCRAM-* authentication. Affects net-imap across 3 version ranges.
>= 0.4.0, < 0.4.24
>= 0.5.0, < 0.5.14
>= 0.6.0, < 0.6.4
Fixed in 0.4.24, 0.5.14 or 0.6.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net-imap package is a Ruby library that provides a client interface for the Internet Message Access Protocol (IMAP), allowing users to interact with email servers. It supports various authentication mechanisms, including SCRAM-SHA1 and SCRAM-SHA256. The package is widely used for email applications and services that require secure and efficient email retrieval. However, it is vulnerable to a denial-of-service attack when a hostile server sends a large iteration count during SCRAM authentication, potentially freezing the Ruby VM.
Vulnerability Detail
The vulnerability arises when an IMAP server sends an excessively large PBKDF2 iteration count in the SCRAM server-first-message. This causes the client to execute a resource-intensive OpenSSL::KDF.pbkdf2_hmac call, which is a blocking operation. As a result, the entire Ruby VM can become unresponsive for an extended period, depending on the hardware and OpenSSL version. This vulnerability is recognized in RFC 7804 as a potential denial-of-service attack vector, emphasizing the need for client implementations to enforce maximum iteration counts.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.4.0, < 0.4.240.4.24gem install net-imap -v 0.4.24 -
>= 0.5.0, < 0.5.140.5.14gem install net-imap -v 0.5.14 -
>= 0.6.0, < 0.6.40.6.4gem install net-imap -v 0.6.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using SCRAM authentication mechanisms when connecting to untrusted IMAP servers. This can help prevent potential denial-of-service attacks until the package is updated.
Conclusion
The net-imap package is vulnerable to a denial-of-service attack via high iteration counts in SCRAM authentication. Users are advised to upgrade to the latest patched versions and implement safe maximum iteration counts to mitigate this risk. Temporary workarounds include avoiding SCRAM mechanisms with untrusted servers.
See every vulnerability recorded for net-imap →
FAQ
The vulnerability allows a hostile server to send a large iteration count during SCRAM authentication, causing a denial-of-service condition by freezing the Ruby VM.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The patched versions of net-imap are 0.6.4, 0.5.14, and 0.4.24 or later.
If you cannot upgrade immediately, avoid using SCRAM authentication with untrusted servers as a temporary workaround.
The CVSS score of this vulnerability is 6.0, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for net-imap.
