Ruby net-imap EUVD-2026-38352

Exploitation requires two independent conditions to hold simultaneously. First, the application must pass unvalidated, user-controlled string data as a raw data argument to one of the affected Net::IMAP methods: the criteria argument of #search or #uid_search, the search_keys argument of #sort, #thread, #uid_sort, or #uid_thread, or the attr argument of #fetch or #uid_fetch - developer misuse of the raw data API is a prerequisite, and well-written applications that sanitize inputs are not vulnerable. Second, the IMAP server the library connects to must NOT advertise LITERAL+, LITERAL-, or IMAP4rev2 capabilities, and must respond to a malformed non-synchronizing literal by returning a tagged BAD response rather than closing the TCP connection outright; cautious servers that close the connection block the injection path entirely. Exploitation is further limited by the fact that the net-imap client must already be authenticated to the IMAP server - CVSS vector is not available to confirm authentication requirements, but the attack operates within the authenticated session's mailbox permissions. Authentication requirements are not confirmed from available CVSS data.

No CVSS score or vector has been published for this CVE at time of analysis, making quantitative risk comparison impossible. The upstream advisory classifies severity as moderate. Real-world exploitability is gated by two independent conditions that must both be true: the application must pass unsanitized user-controlled input to an affected raw data argument, and the IMAP server must lack LITERAL+, LITERAL-, or IMAP4rev2 support AND must respond to malformed non-synchronizing literals by returning BAD (rather than closing the connection). The advisory explicitly notes that most modern IMAP servers support LITERAL-, substantially limiting the exposed population. The impact, while not enabling direct data exfiltration, allows injection of arbitrary IMAP commands (e.g., DELETE, RENAME mailboxes) within the permissions of the authenticated session. KEV status is absent and no public POC has been identified, suggesting this is not being actively exploited at scale. The risk is real for legacy or non-standard IMAP server deployments where developers pass unvalidated user input to affected methods.

An attacker with access to a web application that accepts user-defined IMAP search filters (e.g., a webmail search interface) crafts a criteria string containing a CRLF sequence followed by a complete IMAP command, such as \r\nA001 DELETE INBOX\r\n. When the application passes this input unvalidated to net-imap's #search method as a raw data argument and the IMAP server does not support non-synchronizing literals, the server responds with tagged BAD to the malformed literal marker and then processes the injected DELETE INBOX as a new pipelined command, deleting the mailbox. No public POC has been identified at time of analysis, but the attack is conceptually straightforward for an attacker familiar with IMAP protocol pipelining mechanics.