Skip to content

Commit 138fa7b

Browse files
flavorjonesflavorjones
committed
GHSA/SYNC: 5 brand new net-imap advisories
1 parent df41005 commit 138fa7b

5 files changed

Lines changed: 289 additions & 0 deletions

File tree

‎gems/net-imap/CVE-2026-42245.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
---
2+
gem: net-imap
3+
cve: 2026-42245
4+
ghsa: q2mw-fvj9-vvcw
5+
url: https://github.com/ruby/net-imap/security/advisories/GHSA-q2mw-fvj9-vvcw
6+
title: net-imap has quadratic complexity when reading response literals
7+
date: 2026-05-04
8+
description: |
9+
### Summary
10+
11+
`Net::IMAP::ResponseReader` has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack.
12+
13+
### Details
14+
15+
For each literal in a response, `ResponseReader` rescans the entire growing response buffer. The regular expression that is used to scan the response buffer runs in linear time. With many literals, this becomes O(n²) total work. The regular expression should run in constant time: it is anchored to the end and only the last 23 bytes of the buffer are relevant.
16+
17+
Because the algorithmic complexity is super-linear, this bypasses protection from `max_response_size`: a response can stay well below the default size limit while still causing very large CPU cost.
18+
19+
`Net::IMAP::ResponseReader` runs continuously in the receiver thread until the connection closes.
20+
21+
### Impact
22+
23+
This consumes disproportionate CPU time in the client's receiver thread. A hostile server could use this to exhaust the client's CPU for a denial of service attack.
24+
25+
For a response near the default `max_response_size`, each individual regexp scan could take between 100 to 200ms on common modern hardware, and this may be repeated 200k times per megabyte of response. While the regexp is scanning, it retains the Global VM lock, preventing other threads from running.
26+
27+
Although other threads should not be _completely_ blocked, their run time will be significantly impacted.
28+
29+
### Mitigation
30+
31+
* Upgrade to a patched version of net-imap that reads responses more efficiently.
32+
* Do not connect to untrusted IMAP servers.
33+
* When connecting to untrusted servers, a _much_ smaller `max_response_size` (for example: 8KiB) will limit the impact. Although this is too small for fetching unpaginated message bodies, it should be enough for most other operations.
34+
cvss_v4: 2.3
35+
patched_versions:
36+
- "~> 0.4.24"
37+
- "~> 0.5.14"
38+
- ">= 0.6.4"
39+
related:
40+
url:
41+
- url: https://github.com/ruby/net-imap/security/advisories/GHSA-q2mw-fvj9-vvcw
42+
- url: https://github.com/ruby/net-imap/commit/6091f7d6b1f3514cafbfe39c76f2b5d73de3ca96
43+
- url: https://github.com/ruby/net-imap/commit/88d95231fc8afef11c1f074453f7d75b68c9dfda
44+
- url: https://github.com/ruby/net-imap/commit/de685f91a4a4cc75eb80da898c2bf8af08d34819
45+
- url: https://github.com/ruby/net-imap/releases/tag/v0.4.24
46+
- url: https://github.com/ruby/net-imap/releases/tag/v0.5.14
47+
- url: https://github.com/ruby/net-imap/releases/tag/v0.6.4
48+
- url: https://github.com/advisories/GHSA-q2mw-fvj9-vvcw

‎gems/net-imap/CVE-2026-42246.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
gem: net-imap
3+
cve: 2026-42246
4+
ghsa: vcgp-9326-pqcp
5+
url: https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp
6+
title: net-imap vulnerable to STARTTLS stripping via invalid response timing
7+
date: 2026-05-04
8+
description: |
9+
### Summary
10+
11+
A man-in-the-middle attacker can cause `Net::IMAP#starttls` to return "successfully", without starting TLS.
12+
13+
### Details
14+
15+
When using `Net::IMAP#starttls` to upgrade a plaintext connection to use TLS, a man-in-the-middle attacker can inject a tagged `OK` response with an easily predictable tag. By sending the response before the client finishes sending the command, the command completes "successfully" before the response handler is registered. This allows `#starttls` to return without error, but the response handler is never invoked, the TLS connection is never established, and the socket remains unencrypted.
16+
17+
This allows man-in-the-middle attackers to perform a STARTTLS stripping attack, unless the client code explicitly checks `Net::IMAP#tls_verified?`.
18+
19+
### Impact
20+
21+
TLS bypass, leading to cleartext transmission of sensitive information.
22+
23+
### Mitigation
24+
25+
* Upgrade to a patched version of net-imap that raises an exception whenever `#starttls` does not establish TLS.
26+
* Connect to an implicit TLS port, rather than use `STARTTLS` with a cleartext port.
27+
This is strongly recommended anyway:
28+
* [RFC 8314](https://www.rfc-editor.org/info/rfc8314): Cleartext Considered Obsolete: Use of Transport Layer Security (TLS) for Email Submission and Access
29+
* [NO STARTTLS](https://nostarttls.secvuln.info/): Why TLS is better without STARTTLS, A Security Analysis of STARTTLS in the Email Context
30+
* Explicitly verify `Net::IMAP#tls_verified?` is `true`, before using the connection after `#starttls`.
31+
cvss_v4: 7.6
32+
patched_versions:
33+
- "~> 0.3.10"
34+
- "~> 0.4.24"
35+
- "~> 0.5.14"
36+
- ">= 0.6.4"
37+
related:
38+
url:
39+
- url: https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp
40+
- url: https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618
41+
- url: https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e
42+
- url: https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c
43+
- url: https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da
44+
- url: https://github.com/ruby/net-imap/releases/tag/v0.3.10
45+
- url: https://github.com/ruby/net-imap/releases/tag/v0.4.24
46+
- url: https://github.com/ruby/net-imap/releases/tag/v0.5.14
47+
- url: https://github.com/ruby/net-imap/releases/tag/v0.6.4
48+
- url: https://nostarttls.secvuln.info
49+
- url: https://www.rfc-editor.org/info/rfc8314
50+
- url: https://github.com/advisories/GHSA-vcgp-9326-pqcp

‎gems/net-imap/CVE-2026-42256.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
gem: net-imap
3+
cve: 2026-42256
4+
ghsa: 87pf-fpwv-p7m7
5+
url: https://github.com/ruby/net-imap/security/advisories/GHSA-87pf-fpwv-p7m7
6+
title: net-imap vulnerable to denial of service via high iteration count for `SCRAM-*`
7+
authentication
8+
date: 2026-05-04
9+
description: |
10+
When authenticating a connection with `SCRAM-SHA1` or `SCRAM-SHA256`, a hostile server can perform
11+
a computational denial-of-service attack on the client process by sending a big iteration count
12+
value.
13+
14+
### Details
15+
16+
A hostile IMAP server can send an arbitrarily large PBKDF2 iteration count in the SCRAM
17+
server-first-message, causing the client to perform an expensive `OpenSSL::KDF.pbkdf2_hmac` call.
18+
Because the PBKDF2 function is a blocking C extension and holds onto Ruby’s Global VM Lock, it can
19+
freeze the entire Ruby VM for the duration of the computation.
20+
21+
OpenSSL enforces an effective maximum by using a 32-bit signed integer for the iteration count,
22+
Depending on hardware capabilities and OpenSSL version, this iteration count may be sufficient for
23+
to block all Ruby threads in the process for over seven minutes.
24+
25+
This is listed as one of the \"Security Considerations\", in
26+
[RFC 7804](https://www.rfc-editor.org/rfc/rfc7804.html#page-15):
27+
28+
> A hostile server can perform a computational denial-of-service attack on clients by sending a
29+
> big iteration count value. In order to defend against that, a client implementation can pick a
30+
> maximum iteration count that it is willing to use and reject any values that exceed that
31+
> threshold (in such cases, the client, of course, has to fail the authentication).
32+
33+
### Impact
34+
35+
During SCRAM authentication to a hostile server, the entire Ruby VM will be locked for the
36+
duration of the computation. Depending on hardware capabilities and OpenSSL version, this may
37+
take many minutes.
38+
39+
`OpenSSL::KDF.pbkdf2_hmac` is a blocking C function, so `Timeout` cannot be used to guard against
40+
this. And it retains the Global VM lock, so other ruby threads will also be unable to run.
41+
42+
### Mitigation
43+
44+
* Upgrade to a patched version of `net-imap` that adds the `max_iterations` option to the `SASL-*`
45+
authenticators, and call `Net::IMAP#authenticate` with a `max_iterations` keyword argument.
46+
47+
**NOTE:** The default `max_iterations` is `2³¹ - 1`, the maximum signed 32 bit integer, the
48+
maximum allowed by OpenSSL.
49+
50+
_To prevent a denial of service attack,_ this must be set to a safe value, depending on hardware
51+
and version of OpenSSL. _It is the user's responsibility_ to enforce minimum and maximum
52+
iteration counts that are appropriate for their security context.
53+
54+
* Alternatively, avoid `SCRAM-*` mechanisms when authenticating to untrusted servers.
55+
cvss_v4: 6.0
56+
unaffected_versions:
57+
- "< 0.4.0"
58+
patched_versions:
59+
- "~> 0.4.24"
60+
- "~> 0.5.14"
61+
- ">= 0.6.4"
62+
related:
63+
url:
64+
- url: https://github.com/ruby/net-imap/security/advisories/GHSA-87pf-fpwv-p7m7
65+
- url: https://github.com/ruby/net-imap/commit/158d0b505074397cdb5ceb58935e42dd2bcfa612
66+
- url: https://github.com/ruby/net-imap/commit/808001bc45c06f7297a7e96d341279e041a7f7f4
67+
- url: https://github.com/ruby/net-imap/commit/99f59eab6064955a23debd95410263ad144df758
68+
- url: https://github.com/ruby/net-imap/releases/tag/v0.4.24
69+
- url: https://github.com/ruby/net-imap/releases/tag/v0.5.14
70+
- url: https://github.com/ruby/net-imap/releases/tag/v0.6.4
71+
- url: https://www.rfc-editor.org/rfc/rfc7804.html#page-15
72+
- url: https://github.com/advisories/GHSA-87pf-fpwv-p7m7

‎gems/net-imap/CVE-2026-42257.yml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
---
2+
gem: net-imap
3+
cve: 2026-42257
4+
ghsa: hm49-wcqc-g2xg
5+
url: https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg
6+
title: net-imap vulnerable to command Injection via "raw" arguments to multiple commands
7+
date: 2026-05-04
8+
description: |
9+
### Summary
10+
11+
Several `Net::IMAP` commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain `CRLF` sequences, which an attacker can use to inject arbitrary IMAP commands.
12+
13+
### Details
14+
15+
`Net::IMAP`'s generic argument handling, used by most command arguments, interprets string arguments as an IMAP `astring`. Depending on the string contents and the connection's UTF-8 support, this encodes strings as either a `atom`, `quoted`, or `literal`. These are safe from command or argument injection.
16+
17+
But the following commands transform specific String arguments to `Net::IMAP::RawData`, which bypasses normal argument validation and encoding and prints the string directly to the socket:
18+
* `#uid_search`, `#search`
19+
* when `criteria` is a String, it is sent raw
20+
* `#uid_fetch`, `#fetch`
21+
* when `attr` is a String, it is sent raw
22+
* when `attr` is an Array, each String in `attr` is sent raw
23+
* `#uid_store`, `#store`
24+
* when `attr` is a String, it is sent raw
25+
* `#setquota`:
26+
* `limit` is interpolated with `#to_s` and that string is sent raw
27+
28+
Because these string arguments are sent without any neutralization, they serve as a direct vector for command splitting. Any user controlled data interpolated into these strings can be used to break out of the intended command context.
29+
30+
Using "raw data" arguments for `#uid_store`, `#store`, and `#setquota` I both inappropriate and unnecessary. `Net::IMAP`'s generic argument handling is sufficient to safely validate and encode their arguments. Users of the library probably do not expect arguments to these commands to be sent raw and might not be wary of passing unvalidated input.
31+
32+
The API for search criteria and fetch attributes is intentionally low-level and "close to the wire". It allows developers to use some IMAP extensions without requiring explicit support from the library and allows developers to use complex IMAP grammar without complex argument translation. Even so, basic validation is appropriate and could neutralize command injection.
33+
34+
Although this was explicitly documented for search `criteria`, it was insufficiently documented for fetch `attr`. So developers may not have realized that the `attr` argument to `#fetch` and `#uid_fetch` is sent as "raw data".
35+
36+
### Impact
37+
38+
If a developer passes an unvalidated user-controlled input for one of these method arguments, an attacker can append CRLF sequence followed by a new IMAP command (like DELETE mailbox). Although this does not _directly_ enable data exfiltration, it could be combined with other attack vectors or knowledge of the target system's attributes, e.g.: shared mail folders or the application's installed response handlers.
39+
40+
The SEARCH, STORE, and FETCH commands, and their UID variants are some of the most commonly used features of the library. Applications that build search queries or fetch attributes dynamically based on user input (e.g., mail clients or archival tools) may be at significant risk.
41+
42+
Expected use of `Net::IMAP#setquota` is much more limited: `SETQUOTA` is often only usable by users with special administrative privileges. Depending on the server, quota administration might be managed through server configuration rather than via the IMAP protocol `SETQUOTA` command. It is expected to be uncommonly used in system administration scripts or in interactive sessions, it should be completely controlled by trusted users, and should only use trusted inputs. Calling `#setquota` with untrusted user input is expected to be a very uncommon use case. Please note however this might be combined with other attacks, for example CSRF, which provide unauthorized access to trusted inputs, and may specifically target users or scripts with administrator privileges.
43+
44+
### Mitigation
45+
46+
- Update to a patched version of `net-imap` which:
47+
- validates that `Net::IMAP::RawData` is composed of well-formed IMAP `text`, `literal`, and `literal8` values, with no unescaped `NULL`, `CR`, or `LF` bytes.
48+
- does not use `Net::IMAP::RawData` for `#store`, `#uid_store`, or `#setquota`.
49+
- Prefer to send search criteria as an array of key value pairs. Avoid sending it as an interpolated string.
50+
- If an immediate upgrade is not possible:
51+
- String inputs to search criteria and fetch attributes can be validated against command injection by checking for `\r` and `\n` characters.
52+
- Hard-coding the store `attr` argument is often appropriate. Alternatively, user controlled inputs can be restricted to a small enumerated list which is valid for the calling application.
53+
- Use `Kernel#Integer` to coerce and validate user controlled inputs to `#setquota` limit.
54+
cvss_v4: 5.8
55+
patched_versions:
56+
- "~> 0.4.24"
57+
- "~> 0.5.14"
58+
- ">= 0.6.4"
59+
related:
60+
url:
61+
- url: https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg
62+
- url: https://github.com/ruby/net-imap/commit/0ec4fd351263e8b9a4f683713427827b7b1ad974
63+
- url: https://github.com/ruby/net-imap/commit/47c72186d272441878ca73c9499f66013829ca2f
64+
- url: https://github.com/ruby/net-imap/commit/6bf02aef7e0b5931010c36e377f79a71636b306b
65+
- url: https://github.com/ruby/net-imap/commit/a4f7649c3da77dec7631f03a037a478eb4330048
66+
- url: https://github.com/ruby/net-imap/commit/aec06996eb87a7e1bbcef1f9f8926e8add2b8c71
67+
- url: https://github.com/ruby/net-imap/releases/tag/v0.4.24
68+
- url: https://github.com/ruby/net-imap/releases/tag/v0.5.14
69+
- url: https://github.com/ruby/net-imap/releases/tag/v0.6.4
70+
- url: https://github.com/advisories/GHSA-hm49-wcqc-g2xg

‎gems/net-imap/CVE-2026-42258.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
gem: net-imap
3+
cve: 2026-42258
4+
ghsa: 75xq-5h9v-w6px
5+
url: https://github.com/ruby/net-imap/security/advisories/GHSA-75xq-5h9v-w6px
6+
title: net-imap vulnerable to command Injection via unvalidated Symbol inputs
7+
date: 2026-05-04
8+
description: |-
9+
### Summary
10+
11+
Symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands.
12+
13+
### Details
14+
15+
Symbol arguments represent IMAP "system flags", which are formatted as "atoms" (with no quoting) with a `"\"` prefix. Vulnerable versions of Net::IMAP sends the symbol name directly to the socket, with no validation.
16+
17+
Because the Symbol input is unvalidated, it could contain invalid `flag` characters, including `SP` and `CRLF`, which could be used to finish the current command and inject new commands.
18+
19+
Although IMAP `flag` arguments are only valid input for a few IMAP commands, most Net::IMAP commands use generic argument handling, and will allow Symbol (`flag`) inputs.
20+
21+
Note also that the list of valid symbol inputs should be restricted to an enumerated set of standard RFC defined flag types, which have each been given specific defined semantics. Any user-provided values outside of that list of standard "system flags" needs to use the IMAP `keyword` syntax, which are sent as atoms, i.e: string inputs. Under no circumstances should `#to_sym` ever be called on unvetted user-provided input: that will always be a bug in the calling code for the simple reason that `user_input_atom` is as `\user_input_atom`.
22+
23+
For forward compatibility with future IMAP extentions, Net::IMAP, does not restrict flag inputs to an enumerated list. That is the responsibility of the calling application code, which knows which flag semantics are valid for its context.
24+
25+
### Impact
26+
27+
If a developer passes user-controlled input as a Symbol to most Net::IMAP commands, an attacker can append CRLF sequence followed by a new IMAP command (like `DELETE mailbox`).
28+
29+
### Mitigation
30+
* Upgrade to a version of Net::IMAP that validates Symbols are valid as an IMAP `flag`.
31+
* User-provided input should never be able to control calling `#to_sym` on string arguments.
32+
33+
For example, do not unsafely serialize and deserialize command arguments (e.g. with YAML or Marshal) in a way that could create unvetted Symbol arguments.
34+
* For the few IMAP commands which do allow `flag` arguments, it may be appropriate to hard-code Symbol arguments or restrict them to an enumerated list which is valid for the calling application.
35+
cvss_v4: 5.8
36+
patched_versions:
37+
- "~> 0.4.24"
38+
- "~> 0.5.14"
39+
- ">= 0.6.4"
40+
related:
41+
url:
42+
- url: https://github.com/ruby/net-imap/security/advisories/GHSA-75xq-5h9v-w6px
43+
- url: https://github.com/ruby/net-imap/commit/6bf02aef7e0b5931010c36e377f79a71636b306b
44+
- url: https://github.com/ruby/net-imap/commit/9db3e9d60bfb8f3735ea95015bf8a700f4af9cbb
45+
- url: https://github.com/ruby/net-imap/commit/aec06996eb87a7e1bbcef1f9f8926e8add2b8c71
46+
- url: https://github.com/ruby/net-imap/releases/tag/v0.4.24
47+
- url: https://github.com/ruby/net-imap/releases/tag/v0.5.14
48+
- url: https://github.com/ruby/net-imap/releases/tag/v0.6.4
49+
- url: https://github.com/advisories/GHSA-75xq-5h9v-w6px

0 commit comments

Comments
 (0)