CVE-2026-47241: Net::IMAP Denial of Service via Incomplete Raw Argument Validation
Summary
CVE-2026-47241: Net::IMAP: Denial of Service via incomplete raw argument validation. Affects net-imap across 2 version ranges.
< 0.5.15
>= 0.6.0, < 0.6.4.1
Fixed in 0.5.15 or 0.6.4.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Net::IMAP is a Ruby library that provides an interface for interacting with Internet Message Access Protocol (IMAP) servers. It allows users to manage and retrieve emails from their mail servers. The library is widely used in applications that require email functionalities, making it crucial for maintaining reliable communication. However, it is susceptible to vulnerabilities that can lead to denial of service attacks, particularly when user-controlled input is not properly validated.
Vulnerability Detail
The vulnerability arises from several Net::IMAP commands that accept raw string arguments, which are only partially validated to prevent CRLF injection. If an attacker provides a crafted string derived from user input, they can manipulate the command flow, causing the first command to hang until another command is issued. This can lead to unexpected crashes and timeouts, effectively creating a denial of service scenario. The issue is exacerbated in multi-threaded environments where commands may not be synchronized, leading to further complications.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.5.150.5.15gem install net-imap -v 0.5.15 -
>= 0.6.0, < 0.6.4.10.6.4.1gem install net-imap -v 0.6.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not possible, validate user input to ensure that it does not end with '}' before passing it to the affected command arguments. Additionally, implement timeout strategies to handle slow connections and misbehaving servers. Here is a sample code snippet for input validation:
if user_input.end_with?('}') raise 'Invalid input: cannot end with }' end
Conclusion
CVE-2026-47241 represents a significant risk for applications using the Net::IMAP library, particularly in multi-threaded environments. It is essential to update to the patched versions or implement workarounds to mitigate potential denial of service attacks.
See every vulnerability recorded for net-imap →
FAQ
CVE-2026-47241 is a vulnerability in the Net::IMAP library that allows for denial of service attacks due to incomplete validation of raw string arguments.
If your application uses the Net::IMAP library and accepts user input for IMAP commands, it may be vulnerable to denial of service attacks, leading to application hangs or crashes.
Versions of net-imap prior to 0.6.4.1 and 0.5.15 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If upgrading is not feasible, ensure that user inputs are validated to prevent the use of invalid characters and implement timeout strategies to mitigate the effects of this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for net-imap.
