{"action":"Upgrade net-imap to 0.4.24 or later.","affected":[{"fixed":"0.6.4","introduced":"0.6.0"},{"fixed":"0.5.14","introduced":"0.5.0"},{"fixed":"0.4.24","introduced":"0.4.0"}],"component":"net-imap","cve_ids":["CVE-2026-42256"],"ecosystem":"RubyGems","epss":0.00299,"exploited":false,"fixed_versions":["0.6.4","0.5.14","0.4.24"],"ghsa_id":"GHSA-87pf-fpwv-p7m7","id":"tcs_01M5KEHY2V2YAK105M8FTM84RR","modified_at":"2026-09-10T03:51:04.948392726Z","published_at":"2026-05-04T22:03:28Z","references":["https://osv.dev/vulnerability/GHSA-87pf-fpwv-p7m7","https://github.com/ruby/net-imap/security/advisories/GHSA-87pf-fpwv-p7m7","https://nvd.nist.gov/vuln/detail/CVE-2026-42256","https://github.com/ruby/net-imap/commit/158d0b505074397cdb5ceb58935e42dd2bcfa612","https://github.com/ruby/net-imap/commit/808001bc45c06f7297a7e96d341279e041a7f7f4","https://github.com/ruby/net-imap/commit/99f59eab6064955a23debd95410263ad144df758","https://github.com/ruby/net-imap","https://github.com/ruby/net-imap/releases/tag/v0.4.24","https://github.com/ruby/net-imap/releases/tag/v0.5.14","https://github.com/ruby/net-imap/releases/tag/v0.6.4","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/net-imap/CVE-2026-42256.yml","https://www.rfc-editor.org/rfc/rfc7804.html#page-15"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-87pf-fpwv-p7m7","url":"https://osv.dev/vulnerability/GHSA-87pf-fpwv-p7m7"},{"source":"nvd","source_id":"CVE-2026-42256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42256"}],"summary":"net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication"}