CVE-2026-47242

Name of the Vulnerable Software and Affected Versions Net::IMAP versions prior to 0.5.15 Net::IMAP versions prior to 0.6.5

Description The Net::IMAP#id and Net::IMAP#enable functions do not properly validate their arguments. When Net::IMAP#id is called with a hash argument, it fails to prohibit CRLF (Carriage Return Line Feed) sequences, which are special characters used to indicate the end of a line. Similarly, Net::IMAP#enable does not validate arguments as valid atoms, sending the #to s value verbatim. An attacker providing untrusted input to these commands could inject arbitrary IMAP commands, such as deleting a mailbox.

Recommendations Update to version 0.5.15. Update to version 0.6.5. Avoid using untrusted inputs for Net::IMAP#enable arguments. Ensure client ID field values do not contain CR or LF bytes or implement validation to prohibit these characters.