A man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS.
When using Net::IMAP#starttls to upgrade a plaintext connection to use TLS, a man-in-the-middle attacker can inject a tagged OK response with an easily predictable tag. By sending the response before the client finishes sending the command, the command completes "successfully" before the response handler is registered. This allows #starttls to return without error, but the response handler is never invoked, the TLS connection is never established, and the socket remains unencrypted.
This allows man-in-the-middle attackers to perform a STARTTLS stripping attack, unless the client code explicitly checks Net::IMAP#tls_verified?.
TLS bypass, leading to cleartext transmission of sensitive information.
#starttls does not establish TLS.STARTTLS with a cleartext port.Net::IMAP#tls_verified? is true, before using the connection after #starttls.| Score | Percentile |
|---|---|
| 0.07% | 20.35% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 7.6 | 4.0 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-vcgp-9326-pqcp ↗ |
| CVE | CVE-2026-42246 ↗ |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| rubygems | net-imap | >= 0.6.0, <= 0.6.3 | 0.6.4 | — |
| rubygems | net-imap | >= 0.5.0, <= 0.5.13 | 0.5.14 | — |
| rubygems | net-imap | >= 0.4.0, <= 0.4.23 | 0.4.24 | — |
| rubygems | net-imap | >= 0, <= 0.3.9 | 0.3.10 | — |