Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Fixed packages 24

Vulnerabilities 6

• High 7.6
  CVE-2026-42246

  net-imap vulnerable to STARTTLS stripping via invalid response timing

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issu…

  ruby net-imap logstash-9.3-iamguarded-compat logstash-9.3 Debian Ubuntu Alpine Wolfi RubyGems
  May 9, 2026
• Medium 6.0
  CVE-2026-42256

  net-imap: Denial of service via high iteration count for `SCRAM-*` authentication

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile ser…

  ruby net-imap logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Alpine Wolfi RubyGems
  May 9, 2026
• Medium 5.8
  CVE-2026-47240

  Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a se…

  ruby net-imap logstash-9.3-iamguarded-compat logstash-9.3 Debian Ubuntu Azure Linux Alpine Wolfi RubyGems
  Jun 22, 2026
• Medium 5.8
  CVE-2026-47242

  Net::IMAP: Command Injection via ID command argument

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAP#id is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they w…

  ruby net-imap logstash-9.3-iamguarded-compat logstash-9.3 Debian Ubuntu Azure Linux Alpine Wolfi RubyGems
  Jun 22, 2026
• Low 2.3
  CVE-2026-42245

  net-imap: Quadratic complexity when reading response literals

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hos…

  ruby net-imap logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Alpine Wolfi RubyGems
  May 9, 2026
• Low 2.1
  CVE-2026-47241

  Net::IMAP: Denial of Service via incomplete raw argument validation

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and then sent verbatim. If this str…

  ruby net-imap logstash-9.3-iamguarded-compat logstash-9.3 Debian Ubuntu Alpine Wolfi RubyGems
  Jun 22, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2026-42245
• report
  https://access.redhat.com/security/cve/CVE-2026-42246
• report
  https://access.redhat.com/security/cve/CVE-2026-42256
• report
  https://access.redhat.com/security/cve/CVE-2026-47240
• report
  https://access.redhat.com/security/cve/CVE-2026-47242
• article
  https://access.redhat.com/security/updates/classification/
• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-47241
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33551.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468495
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42245
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42245
• article
  https://github.com/ruby/net-imap/commit/6091f7d6b1f3514cafbfe39c76f2b5d73de3ca96
• article
  https://github.com/ruby/net-imap/commit/88d95231fc8afef11c1f074453f7d75b68c9dfda
• article
  https://github.com/ruby/net-imap/commit/de685f91a4a4cc75eb80da898c2bf8af08d34819
• article
  https://github.com/ruby/net-imap/releases/tag/v0.4.24
• article
  https://github.com/ruby/net-imap/releases/tag/v0.5.14
• article
  https://github.com/ruby/net-imap/releases/tag/v0.6.4
• article
  https://github.com/ruby/net-imap/security/advisories/GHSA-q2mw-fvj9-vvcw
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468499
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42246
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42246
• article
  https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618
• article
  https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e
• article
  https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c
• article
  https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da
• article
  https://github.com/ruby/net-imap/releases/tag/v0.3.10
• article
  https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468500
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42256
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42256
• article
  https://github.com/ruby/net-imap/commit/158d0b505074397cdb5ceb58935e42dd2bcfa612
• article
  https://github.com/ruby/net-imap/commit/808001bc45c06f7297a7e96d341279e041a7f7f4
• article
  https://github.com/ruby/net-imap/commit/99f59eab6064955a23debd95410263ad144df758
• article
  https://github.com/ruby/net-imap/security/advisories/GHSA-87pf-fpwv-p7m7
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2491519
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-47240
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-47240
• article
  https://github.com/ruby/net-imap/security/advisories/GHSA-8p34-64r3-mwg8