GHSA-vcgp-9326-pqcp CVE-2026-42246

net-imap vulnerable to STARTTLS stripping via invalid response timing

High RubyGems

Severity: 0.0 / 10; High · CVSS 4.0
Exploit chance (EPSS): 0.31%; Chance of exploitation in the next 30 days. Higher than 24.18% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-392 Missing Report of Error Condition; CWE-393 Return of Wrong Status Code; CWE-636 Not Failing Securely ('Failing Open'); CWE-754 Improper Check for Unusual or Exceptional Conditions; CWE-841 Improper Enforcement of Behavioral Workflow
Fix: 0.6.4; Upgrade net-imap to this version or later

Description

Summary

A man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS.

Details

When using Net::IMAP#starttls to upgrade a plaintext connection to use TLS, a man-in-the-middle attacker can inject a tagged OK response with an easily predictable tag. By sending the response before the client finishes sending the command, the command completes "successfully" before the response handler is registered. This allows #starttls to return without error, but the response handler is never invoked, the TLS connection is never established, and the socket remains unencrypted.

This allows man-in-the-middle attackers to perform a STARTTLS stripping attack, unless the client code explicitly checks Net::IMAP#tls_verified?.

Impact

TLS bypass, leading to cleartext transmission of sensitive information.

Mitigation

Upgrade to a patched version of net-imap that raises an exception whenever #starttls does not establish TLS.
Connect to an implicit TLS port, rather than use STARTTLS with a cleartext port. This is strongly recommended anyway:
- RFC 8314: Cleartext Considered Obsolete: Use of Transport Layer Security (TLS) for Email Submission and Access
- NO STARTTLS: Why TLS is better without STARTTLS, A Security Analysis of STARTTLS in the Email Context
Explicitly verify Net::IMAP#tls_verified? is true, before using the connection after #starttls.

Affected versions

RubyGems

Package	Vulnerable	Fixed in
net-imap	`>= 0.6.0, < 0.6.4`	`0.6.4`
net-imap	`>= 0.5.0, < 0.5.14`	`0.5.14`
net-imap	`>= 0.4.0, < 0.4.24`	`0.4.24`
net-imap	`< 0.3.10`	`0.3.10`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

net-imap RubyGems → `0.6.4`

bundler

bundle update net-imap # Gemfile: gem "net-imap", ">= 0.6.4"

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: Present
Privileges required: None
User interaction: Passive
Confidentiality (vulnerable system): High
Integrity (vulnerable system): High
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 7.4

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Weakness

CWE-392: Missing Report of Error Condition

The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.

CWE-393: Return of Wrong Status Code

A function or operation returns an incorrect return value or status code that does not indicate the true result of execution, causing the product to modify its behavior based on the incorrect result.

CWE-636: Not Failing Securely ('Failing Open')

When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

How to prevent it

Architecture and Design: Subdivide and allocate resources and components so that a failure in one part does not affect the entire product.

CWE-754: Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

How to prevent it

Requirements: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Choose languages with features such as exception handling that force the programmer to anticipate unusual conditions that may generate exceptions. Custom exceptions may need to be developed to handle unusual business-logic conditions. Be careful not to pass sensitive exceptions back to the user (CWE-209, CWE-248).
Implementation: Check the results of all functions that return a value and verify that the value is expected.
Implementation: If using exception handling, catch and throw specific exceptions instead of overly-general exceptions (CWE-396, CWE-397). Catch and handle exceptions as locally as possible so that exceptions do not propagate too far up the call stack (CWE-705). Avoid unchecked or uncaught exceptions where feasible (CWE-248).
Implementation: Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success. If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not. Exposing additional information to a potential attacker in the context of an exceptional condition can help the attacker determine what attack vectors are most likely to succeed beyond DoS.
Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Architecture and Design, Implementation: If the program must fail, ensure that it fails gracefully (fails closed). There may be a temptation to simply let the program fail poorly in cases such as low memory conditions, but an attacker may be able to assert control before the software has fully exited. Alternately, an uncontrolled failure could cause cascading problems with other downstream components; for example, the program could send a signal to a downstream process so the process immediately knows that a problem has occurred and has a better chance of recovery.
Architecture and Design: Use system limits, which should help to prevent resource exhaustion. However, the product should still handle low resource conditions since they may still occur.

CWE-841: Improper Enforcement of Behavioral Workflow

The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-42246

Packages

github.com/ruby/net-imap

Timeline

May 4, 2026 Published
Sep 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-46q3-7gv7-qmgg Net::IMAP: Command Injection via ID command argument	Medium	Also affects net-imap
GHSA-c4fp-cxrr-mj66 Net::IMAP: Denial of Service via incomplete raw argument validation	Low	Also affects net-imap
GHSA-8p34-64r3-mwg8 Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument	Medium	Also affects net-imap
GHSA-hm49-wcqc-g2xg net-imap vulnerable to command Injection via "raw" arguments to multiple commands	Critical	Also affects net-imap
GHSA-75xq-5h9v-w6px net-imap vulnerable to command Injection via unvalidated Symbol inputs	Medium	Also affects net-imap
GHSA-87pf-fpwv-p7m7 net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication	Medium	Also affects net-imap
GHSA-q2mw-fvj9-vvcw net-imap has quadratic complexity when reading response literals	High	Also affects net-imap
GHSA-j3g3-5qv5-52mj net-imap rubygem vulnerable to possible DoS by memory exhaustion	Medium	Also affects net-imap

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor