CVE-2026-47241
Last modified
CVE-2026-47241 is a low-severity vulnerability rated 2.1/10 on the CVSS scale. Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and then sent verbatim. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and then sent verbatim. If this string is derived from user-controlled input, an attacker can force the next command to be absorbed as a continuation of the first command. This will cause the first command to eventually fail, but also prevents it from returning until another command is sent (from another thread). That other command will not return until the connection is closed. This vulnerability is fixed in 0.6.5 and 0.5.15.
Metrics
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-47241?
How severe is CVE-2026-47241?
How do I fix CVE-2026-47241?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-47234Admidio is an open-source user management solution. Prior to…4.4
- CVE-2026-47236Solidtime is an open-source time-tracking app. Prior to vers…4.3
- CVE-2026-47237Kubeflow Community Distribution helps users to install Kubef…8
- CVE-2026-47238ClipBucket v5 is an open source video sharing platform. Prio…6.5
- CVE-2026-4724Undefined behavior in the Audio/Video component. This vulner…9.1
- CVE-2026-47240Net::IMAP implements Internet Message Access Protocol (IMAP)…5.8
- CVE-2026-47242Net::IMAP implements Internet Message Access Protocol (IMAP)…5.8
- CVE-2026-47243Kata Containers is an open source project focusing on a stan…9.2
- CVE-2026-47244Netty is a network application framework for development of …5.3
- CVE-2026-47247libheif is a HEIF and AVIF file format decoder and encoder. …7.5
- CVE-2026-47248Parse Server is an open source backend that can be deployed …6.9
- CVE-2026-47249Klever-Go is the Go implementation of the Klever blockchain …7.5
Are you affected by CVE-2026-47241?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST