Is CVE-2026-42245 in the CISA KEV catalog?

No. CVE-2026-42245 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2026-42245?

CVE-2026-42245 has a CVSS v3 base score of 7.5 (HIGH).

What is the EPSS score for CVE-2026-42245?

CVE-2026-42245 has an EPSS score of 0.41% (33th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2026-42245?

Upgrade ruby on rhel 10 to 0:3.3.10-11.el10_0.2 or later. Fixes are available for 110 affected products.

CVE & CISA-KEV Catalog

CVE-2026-42245

HIGH

7.5

CVSS v3

NVD

Description

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

CWE-407

How to fix

Remediation Available

rubyRed Hat / RHEL

Fixed in:0:3.3.10-11.el10_0.2RHSA-2026:35895

Fixed in:0:3.3.10-13.el10_2RHSA-2026:33565

Fixed in:0:3.3.10-11.el10_0.2RHSA-2026:35895

Fixed in:0:3.3.10-13.el10_2RHSA-2026:33565

Fixed in:0:3.3.10-11.el10_0.2RHSA-2026:35895

Fixed in:0:3.3.10-13.el10_2RHSA-2026:33565

Fixed in:0:3.3.10-11.el10_0.2RHSA-2026:35895

Fixed in:0:3.3.10-6.module+el9.6.0+24475+76cce029.aarch64::ruby:3.3RHSA-2026:37238

Fixed in:0:3.3.10-7.module+el9.4.0+24474+8fc4d0bd.s390x::ruby:3.3RHSA-2026:36099

Fixed in:0:3.3.10-7.module+el9.8.0+24406+8975e57f.i686::ruby:3.3RHSA-2026:33576

Fixed in:0:3.3.10-7.module+el9.8.0+24406+8975e57f.aarch64::ruby:3.3RHSA-2026:33576

Fixed in:0:4.0.3-33.module+el9.8.0+24428+77f1d00a.aarch64::ruby:4.0RHSA-2026:33577

Fixed in:0:3.3.10-7.module+el8.10.0+24407+4a33a056.s390x::ruby:3.3RHSA-2026:33515

Fixed in:0:3.3.10-7.module+el9.4.0+24474+8fc4d0bd.x86_64::ruby:3.3RHSA-2026:36099

Fixed in:0:3.3.10-7.module+el9.8.0+24406+8975e57f.src::ruby:3.3RHSA-2026:33576

Fixed in:0:3.3.10-7.module+el9.8.0+24406+8975e57f.x86_64::ruby:3.3RHSA-2026:33576

Fixed in:0:4.0.3-33.module+el9.8.0+24428+77f1d00a.x86_64::ruby:4.0RHSA-2026:33577

Fixed in:0:3.3.10-7.module+el9.4.0+24474+8fc4d0bd.aarch64::ruby:3.3RHSA-2026:36099

Fixed in:0:3.3.10-7.module+el8.10.0+24407+4a33a056.src::ruby:3.3RHSA-2026:33515

Fixed in:0:4.0.3-33.module+el9.8.0+24428+77f1d00a.s390x::ruby:4.0RHSA-2026:33577

Fixed in:0:3.3.10-7.module+el9.8.0+24406+8975e57f.ppc64le::ruby:3.3RHSA-2026:33576

Fixed in:0:3.3.10-7.module+el8.10.0+24407+4a33a056.i686::ruby:3.3RHSA-2026:33515

Fixed in:0:3.3.10-7.module+el8.10.0+24407+4a33a056.x86_64::ruby:3.3RHSA-2026:33515

Fixed in:0:3.3.10-7.module+el9.4.0+24474+8fc4d0bd.ppc64le::ruby:3.3RHSA-2026:36099

Fixed in:0:3.3.10-7.module+el9.4.0+24474+8fc4d0bd.src::ruby:3.3RHSA-2026:36099

Fixed in:0:3.3.10-6.module+el9.6.0+24475+76cce029.x86_64::ruby:3.3RHSA-2026:37238

Fixed in:0:3.3.10-7.module+el9.8.0+24406+8975e57f.s390x::ruby:3.3RHSA-2026:33576

Fixed in:0:3.3.10-6.module+el9.6.0+24475+76cce029.ppc64le::ruby:3.3RHSA-2026:37238

Fixed in:0:3.3.10-6.module+el9.6.0+24475+76cce029.s390x::ruby:3.3RHSA-2026:37238

Fixed in:0:3.3.10-6.module+el9.6.0+24475+76cce029.src::ruby:3.3RHSA-2026:37238

Fixed in:0:3.3.10-7.module+el8.10.0+24407+4a33a056.ppc64le::ruby:3.3RHSA-2026:33515

Fixed in:0:3.3.10-6.module+el9.6.0+24475+76cce029.i686::ruby:3.3RHSA-2026:37238

Fixed in:0:4.0.3-33.module+el9.8.0+24428+77f1d00a.ppc64le::ruby:4.0RHSA-2026:33577

Fixed in:0:4.0.3-33.module+el9.8.0+24428+77f1d00a.i686::ruby:4.0RHSA-2026:33577

Fixed in:0:3.3.10-7.module+el9.4.0+24474+8fc4d0bd.i686::ruby:3.3RHSA-2026:36099

Fixed in:0:3.3.10-7.module+el8.10.0+24407+4a33a056.aarch64::ruby:3.3RHSA-2026:33515

Fixed in:0:4.0.3-33.module+el9.8.0+24428+77f1d00a.src::ruby:4.0RHSA-2026:33577

rubyRocky