net-imap CVE-2026-42256

The vulnerability requires the application to initiate SCRAM-SHA1 or SCRAM-SHA256 authentication with an IMAP server. Exploitation depends on attacker control over or network interception of the IMAP server's responses. If the IMAP server requires TLS, the attacker must either compromise the server, perform a man-in-the-middle attack (requires breaking TLS), or the application must connect without certificate validation. The application must be running an unpatched version of net-imap (0.4.0-0.4.23, 0.5.0-0.5.13, or 0.6.0-0.6.3). Even patched versions remain vulnerable unless the application explicitly sets max_iterations to a protective value below the default 2³¹-1; the patch provides the mechanism but does not change the default unsafe maximum. No special configuration or non-standard IMAP features are required - standard SCRAM authentication during initial connection attempt is sufficient.

This is a high-impact denial of service vulnerability despite the absence of a CVSS score. The exploitation is straightforward and requires only network access to an IMAP server (AV:N), zero complexity to trigger (AC:L), and no authentication (PR:N), making it remotely exploitable by any attacker operating a malicious IMAP server or intercepting connections. The impact is severe: all Ruby threads in affected processes freeze completely for minutes, effectively halting any application using net-imap for IMAP authentication. Standard Ruby Timeout mechanisms cannot interrupt the blocking C call, and Ruby's threading model provides no protection. The vulnerability affects all three recent version lines (0.4.x, 0.5.x, 0.6.x), indicating wide exposure in the Ruby ecosystem. However, exploitation requires either a compromised IMAP server, man-in-the-middle capability, or victim misconfiguration to connect to attacker-controlled servers. The severity is partially mitigated by the fact that the default patched behavior (introduced in 0.4.24+, 0.5.14+, 0.6.4+) sets max_iterations to the maximum allowed value unless explicitly configured by users - meaning patched systems remain vulnerable unless developers actively set a protective limit. The real risk depends heavily on whether applications update AND configure the max_iterations parameter appropriately for their hardware and OpenSSL version.

An attacker operates a malicious IMAP server or intercepts an unencrypted IMAP connection. A Ruby application connects and initiates SCRAM authentication. The attacker's server responds with a SCRAM server-first-message containing iterations=2147483647 (the maximum 32-bit signed integer). The client's net-imap library calls OpenSSL::KDF.pbkdf2_hmac with this iteration count, causing the Ruby VM to perform over 2 billion PBKDF2 rounds, completely freezing all application threads for 5-10+ minutes depending on processor speed and OpenSSL version. During this time, the application cannot handle requests, process other events, or respond to timeouts.