Ruby Net::IMAP <=0.6.4 MITM Without TLS on starttls
CVE-2026-42246 Published on May 9, 2026

net-imap vulnerable to STARTTLS stripping via invalid response timing
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.

NVD

Vulnerability Analysis

CVE-2026-42246 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Types

Missing Report of Error Condition

The software encounters an error but does not provide a status code or return value to indicate that an error has occurred.

Return of Wrong Status Code

A function or operation returns an incorrect return value or status code that does not indicate an error, but causes the product to modify its behavior based on the incorrect result. This can lead to unpredictable behavior. If the function is used to make security-critical decisions or provide security-critical information, then the wrong status code can cause the software to assume that an action is safe, even when it is not.

Improper Check for Unusual or Exceptional Conditions

The software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.

What is a Failing Open Vulnerability?

When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions. By entering a less secure state, the product inherits the weaknesses associated with that state, making it easier to compromise. At the least, it causes administrators to have a false sense of security. This weakness typically occurs as a result of wanting to "fail functional" to minimize administration and support costs, instead of "failing safe."

CVE-2026-42246 has been classified to as a Failing Open vulnerability or weakness.

Improper Enforcement of Behavioral Workflow

The software supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

Missing Cryptographic Step

The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.


Products Associated with CVE-2026-42246

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-42246 are published in these products:

Canonical Ubuntu Linux
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Hummingbird
 
Red Hat Openshift
 
Red Hat 3scale Amp
 
Red Hat Rhel Eus
 
Red Hat Rhel E4s
 
Red Hat Rhel Tus
 
Red Hat Rhel Aus
 
Red Hat Rhel Eus Long Life
 
Red Hat Enterprise Linux Eus
 
Red Hat Rhel Els
 

Affected Versions

ruby net-imap: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10.0 Extended Update Support: Red Hat Enterprise Linux 7 Extended Lifecycle Support: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On: Red Hat Enterprise Linux 8.8 Telecommunications Update Service: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat Hardened Images: Red Hat Hardened Images: Red Hat Hardened Images: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat Enterprise Linux 6: Red Hat OpenShift Container Platform 4:

Exploit Probability

EPSS
0.42%
Percentile
33.63%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.