Cyber Resilience

CVE-2026-42257

Medium

Published: 09 May 2026

Published
09 May 2026
Modified
18 May 2026
KEV Added
—
Patch
—
CVSS Score v4 5.8 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0043 34.5th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-42257 is a medium-severity Command Injection (CWE-77) vulnerability in Ruby-Lang Net\. Its CVSS base score is 5.8 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is…

more

derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

CWE(s)
CWE-77CWE-93

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
Why these techniques?

CRLF injection in IMAP client library directly enables exploitation of public-facing apps (T1190) and client-side code execution via arbitrary protocol commands (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

ruby-lang
net\
\

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References