CVE-2026-47241 (Low) detected in net-imap-0.6.3.gem

[mend-bolt-for-github]

CVE-2026-47241 - Low Severity Vulnerability

Vulnerable Library - net-imap-0.6.3.gem

Ruby client api for Internet Message Access Protocol

Library home page: https://rubygems.org/gems/net-imap-0.6.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /tmp/containerbase/cache/.ruby/cache/net-imap-0.6.3.gem

Dependency Hierarchy:

• gettext_i18n_rails_js-1.3.1.gem (Root Library)
  • rails-8.0.4.gem
    • actionmailer-8.0.4.gem
      • mail-2.9.0.gem
        • ❌ net-imap-0.6.3.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and then sent verbatim. If this string is derived from user-controlled input, an attacker can force the next command to be absorbed as a continuation of the first command. This will cause the first command to eventually fail, but also prevents it from returning until another command is sent (from another thread). That other command will not return until the connection is closed. This vulnerability is fixed in 0.6.5 and 0.5.15.

Publish Date: 2026-06-22

URL: CVE-2026-47241

CVSS 3 Score Details (3.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-06-11

Fix Resolution: https://github.com/ruby/net-imap.git - 0.5.15,net-imap - 0.5.15,net-imap - 0.6.4.1

---

Step up your Open Source Security Game with Mend here