CVE-2026-42246: net-imap vulnerable to STARTTLS stripping via invalid response timing
Summary
A man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS.
Details
When using Net::IMAP#starttls to upgrade a plaintext connection to use TLS, a man-in-the-middle attacker can inject a tagged OK response with an easily predictable tag. By sending the response before the client finishes sending the command, the command completes "successfully" before the response handler is registered. This allows #starttls to return without error, but the response handler is never invoked, the TLS connection is never established, and the socket remains unencrypted.
This allows man-in-the-middle attackers to perform a STARTTLS stripping attack, unless the client code explicitly checks Net::IMAP#tlsverified?.
Impact
TLS bypass, leading to cleartext transmission of sensitive information.
Mitigation
Upgrade to a patched version of net-imap that raises an exception whenever #starttls does not establish TLS. Connect to an implicit TLS port, rather than use STARTTLS with a cleartext port. This is strongly recommended anyway: RFC 8314: Cleartext Considered Obsolete: Use of Transport Layer Security (TLS) for Email Submission and Access NO STARTTLS: Why TLS is better without STARTTLS, A Security Analysis of STARTTLS in the Email Context Explicitly verify Net::IMAP#tlsverified? is true, before using the connection after #starttls.
Other sources
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42246?
CVE-2026-42246 is classified as a high severity vulnerability due to its potential for man-in-the-middle attacks.
How do I fix CVE-2026-42246?
To mitigate CVE-2026-42246, upgrade `net-imap` to version 0.3.10 or higher, 0.4.24 or higher, 0.5.14 or higher, or 0.6.4 or higher.
Which versions are affected by CVE-2026-42246?
CVE-2026-42246 affects `net-imap` versions from 0.3.9 to 0.3.9, 0.4.0 to 0.4.23, 0.5.0 to 0.5.13, and 0.6.0 to 0.6.3.
What type of attack does CVE-2026-42246 enable?
CVE-2026-42246 enables a man-in-the-middle attack that allows an attacker to spoof a successful TLS connection.
Should I be concerned about CVE-2026-42246 in my applications?
Yes, you should be concerned about CVE-2026-42246 as it can compromise the security of communications using the `Net::IMAP#starttls` method.