https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-06T14:35:09.732618+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-42257 CVE-2026-42257 — net-imap: Command Injection via "raw" arguments to multiple commands 2026-10-06T14:35:09.783379+00:00

Affected: ruby net-imap

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.