CVE-2026-47240

Name of the Vulnerable Software and Affected Versions Net::IMAP versions prior to 0.6.5 Net::IMAP versions prior to 0.5.15

Description Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Certain commands accept a raw data argument that is sent verbatim after validation. If a server does not support non-synchronizing literals (literals that do not require a server continuation response), it may interpret specific byte sequences as the end of a malformed command line. This allows an attacker to inject arbitrary IMAP commands via a CRLF (Carriage Return Line Feed) injection attack, where the contents of the literal are interpreted as new pipelined commands. This issue affects the criteria parameter for search() and uid search(), the search keys parameter for sort(), thread(), uid sort(), and uid thread(), and the attr parameter for fetch() and uid fetch().

Recommendations Update to version 0.6.5 or later. Update to version 0.5.15 or later. Explicitly validate user-controlled inputs to prevent embedded non-synchronizing literals unless the server supports them. Prohibit all embedded literals by ensuring string inputs do not contain any CR or LF bytes. Verify that the server advertises LITERAL+, LITERAL-, or IMAP4rev2 capabilities before using untrusted string inputs for the affected raw data arguments.