{"schema_version":"1.7.5","id":"GHSA-vcgp-9326-pqcp","published":"2026-05-04T22:01:52Z","modified":"2026-05-14T21:05:51.275163Z","aliases":["CVE-2026-42246"],"related":["CGA-p9hp-3w6c-h3pq"],"summary":"net-imap vulnerable to STARTTLS stripping via invalid response timing","details":"### Summary\n\nA man-in-the-middle attacker can cause `Net::IMAP#starttls` to return \"successfully\", without starting TLS.\n\n### Details\n\nWhen using `Net::IMAP#starttls` to upgrade a plaintext connection to use TLS, a man-in-the-middle attacker can inject a tagged `OK` response with an easily predictable tag.  By sending the response before the client finishes sending the command, the command completes \"successfully\" before the response handler is registered.  This allows `#starttls` to return without error, but the response handler is never invoked, the TLS connection is never established, and the socket remains unencrypted.\n\nThis allows man-in-the-middle attackers to perform a STARTTLS stripping attack, unless the client code explicitly checks `Net::IMAP#tls_verified?`.\n\n### Impact\n\nTLS bypass, leading to cleartext transmission of sensitive information.\n\n### Mitigation\n\n* Upgrade to a patched version of net-imap that raises an exception whenever `#starttls` does not establish TLS.\n* Connect to an implicit TLS port, rather than use `STARTTLS` with a cleartext port.\n  This is strongly recommended anyway:\n  * [RFC 8314](https://www.rfc-editor.org/info/rfc8314): Cleartext Considered Obsolete: Use of Transport Layer Security (TLS) for Email Submission and Access\n  * [NO STARTTLS](https://nostarttls.secvuln.info/): Why TLS is better without STARTTLS, A Security Analysis of STARTTLS in the Email Context\n* Explicitly verify `Net::IMAP#tls_verified?` is `true`, before using the connection after `#starttls`.","affected":[{"package":{"name":"net-imap","ecosystem":"RubyGems","purl":"pkg:gem/net-imap"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.0"},{"fixed":"0.6.4"}]}],"versions":["0.6.0","0.6.1","0.6.2","0.6.3"],"database_specific":{"last_known_affected_version_range":"<= 0.6.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-vcgp-9326-pqcp/GHSA-vcgp-9326-pqcp.json"}},{"package":{"name":"net-imap","ecosystem":"RubyGems","purl":"pkg:gem/net-imap"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.0"},{"fixed":"0.5.14"}]}],"versions":["0.5.0","0.5.1","0.5.10","0.5.11","0.5.12","0.5.13","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.5.9"],"database_specific":{"last_known_affected_version_range":"<= 0.5.13","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-vcgp-9326-pqcp/GHSA-vcgp-9326-pqcp.json"}},{"package":{"name":"net-imap","ecosystem":"RubyGems","purl":"pkg:gem/net-imap"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0"},{"fixed":"0.4.24"}]}],"versions":["0.4.0","0.4.1","0.4.10","0.4.11","0.4.12","0.4.13","0.4.14","0.4.15","0.4.16","0.4.17","0.4.18","0.4.19","0.4.2","0.4.20","0.4.21","0.4.22","0.4.23","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.4.8","0.4.9","0.4.9.1"],"database_specific":{"last_known_affected_version_range":"<= 0.4.23","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-vcgp-9326-pqcp/GHSA-vcgp-9326-pqcp.json"}},{"package":{"name":"net-imap","ecosystem":"RubyGems","purl":"pkg:gem/net-imap"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.10"}]}],"versions":["0.1.0","0.1.1","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.4.1","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9"],"database_specific":{"last_known_affected_version_range":"<= 0.3.9","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-vcgp-9326-pqcp/GHSA-vcgp-9326-pqcp.json"}}],"references":[{"type":"WEB","url":"https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42246"},{"type":"WEB","url":"https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618"},{"type":"WEB","url":"https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e"},{"type":"WEB","url":"https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c"},{"type":"WEB","url":"https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da"},{"type":"PACKAGE","url":"https://github.com/ruby/net-imap"},{"type":"WEB","url":"https://github.com/ruby/net-imap/releases/tag/v0.3.10"},{"type":"WEB","url":"https://github.com/ruby/net-imap/releases/tag/v0.4.24"},{"type":"WEB","url":"https://github.com/ruby/net-imap/releases/tag/v0.5.14"},{"type":"WEB","url":"https://github.com/ruby/net-imap/releases/tag/v0.6.4"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/net-imap/CVE-2026-42246.yml"},{"type":"WEB","url":"https://nostarttls.secvuln.info"},{"type":"WEB","url":"https://www.rfc-editor.org/info/rfc8314"}],"database_specific":{"cwe_ids":["CWE-392","CWE-393","CWE-636","CWE-754","CWE-841"],"github_reviewed":true,"github_reviewed_at":"2026-05-04T22:01:52Z","nvd_published_at":"2026-05-09T20:16:28Z","severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}