CVE-2026-42246

HighCVSS 7.4/10Last modified Aug 24, 2026

Description

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-392 CWE-393 CWE-636 CWE-754 CWE-841 CWE-325

Affected software

No affected versions have been published.

Timeline

Published: May 9, 2026
Last modified: Aug 24, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-422489.8Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Win CVE-2026-422499.8Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HT CVE-2026-42252.4A security flaw has been discovered in CMS Made Simple up to 2.2.21. Impacted is an unknown function of the file admin/listusers.php of the CVE-2026-422504.8bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of CVE-2026-422518.7Use of hard-coded credentials in KS-SOMED allowed an unauthorized attacker access to FTP server that hosted the application's update package CVE-2026-422529.1Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") showed a verbatim `BashO CVE-2026-422536.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. CVE-2026-422544.0Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that CVE-2026-422556.5Technitium DNS Server before 15.0 allows DNS traffic amplification via cyclic name server delegation.CVE-2026-422566.5Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to be CVE-2026-422579.8Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, seve CVE-2026-422585.3Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symb