PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42256 ruby CVE debrief

CVE-2026-42256 is a client-side denial-of-service issue in Ruby's Net::IMAP library. When a connection authenticates with SCRAM-SHA1 or SCRAM-SHA256, a hostile IMAP server can send an excessively large iteration count that causes the client process to burn CPU during authentication. The issue is fixed in Net::IMAP 0.4.24, 0.5.14, and 0.6.4.

Vendor
ruby
Product
net-imap
CVSS
MEDIUM 6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-09
Original CVE updated
2026-07-24
Advisory published
2026-05-09
Advisory updated
2026-07-24

Who should care

Teams running Ruby applications that use Net::IMAP and authenticate to IMAP servers with SCRAM-SHA1 or SCRAM-SHA256 should care, especially if the server may be untrusted, externally controlled, or reachable over the internet.

Technical summary

The CVE record says Net::IMAP versions 0.4.0 through before 0.4.24, 0.5.0 through before 0.5.14, and 0.6.0 through before 0.6.4 are affected. During SCRAM-SHA1 or SCRAM-SHA256 authentication, a server can supply a large iteration count value that triggers excessive computation in the client. The result is a denial of service against the client process, not a server compromise. The NVD entry assigns CVSS 4.0 vector elements consistent with network reachability and high availability impact.

Defensive priority

Medium. The impact is availability-focused and requires interaction with a malicious or hostile IMAP server, but affected clients may be exposed during routine mail authentication.

Recommended defensive actions

  • Upgrade Net::IMAP to a fixed release: 0.4.24, 0.5.14, or 0.6.4, depending on the version line in use.
  • Inventory Ruby applications and services that use Net::IMAP so you can confirm whether SCRAM-SHA1 or SCRAM-SHA256 authentication is enabled.
  • Treat IMAP servers you do not fully trust as higher risk until patched clients are deployed.
  • Monitor for unusual CPU spikes or authentication stalls in mail-related workers, which may indicate exposure to this issue.
  • If immediate upgrading is not possible, reduce exposure by avoiding SCRAM-based authentication to untrusted servers until the patch is applied.

Evidence notes

This debrief is based only on the supplied CVE description, the NVD record metadata, and the GitHub security-advisory references listed in the source corpus. The supplied record states the affected version ranges, the hostile-server iteration-count trigger, and the fixed releases. The CVSS data and CWE mappings come from the NVD entry metadata. No additional claims were inferred beyond those sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42256 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42256

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42256 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42256

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.