Sourced from net-imap's releases.
v0.5.15
What's Changed
🔒 Security
This release fixes several more security vulnerabilities which are related to the fixes in
v0.5.14. Please see the linked security advisories for more information.
- (moderate) Command Injection via non-synchronizing literal in "raw" argument (CVE-2026-47240, GHSA-8p34-64r3-mwg8) This vulnerability depends how the server interprets non-synchronizing literals. The connection is not vulnerable if the server supports non-synchronizing literals.
- 🥅 Validate non-synchronizing literals support by
@nevansin ruby/net-imap#703 (backports ruby/net-imap#701)- (moderate) Command Injection via unvalidated ID and ENABLE arguments (CVE-2026-47242, GHSA-46q3-7gv7-qmgg)
- 🥅 Validate
IDvalues contain only valid bytes by@nevansin ruby/net-imap#703 (backports ruby/net-imap#698)- 🥅 Validate
#enablearguments are all atoms by@nevansin ruby/net-imap#703 (backport ruby/net-imap#699) NOTE:#enableshould never be called with untrusted input.- (low) Denial of Service via incomplete "raw" argument validation (CVE-2026-47241, GHSA-c4fp-cxrr-mj66) This results in the affected command hanging until the connection is closed. If another thread attempts to send a concurrent pipelined command, the first thread will return with a syntax error and the second thread will hang until the connection closes.
- Reported by
@fg0x0- 🐛 Prevent trailing
{0}in RawData validation by@nevansin ruby/net-imap#703 (backports ruby/net-imap#700)Fixed
- 🥅 Validate that Atom and Flag are not empty by
@nevansin ruby/net-imap#685 (backports ruby/net-imap#684)- 🧵 Fix deadlock in
#disconnectby@nevansin ruby/net-imap#697 (backports ruby/net-imap#686)Documentation
- ⚠️ Boost visibility of raw data argument documentation warnings by
@nevansin ruby/net-imap#696 (backports ruby/net-imap#677)Other Changes
- 🏷️ Allow 64-bit Integer arguments in ruby/net-imap#696 (backports ruby/net-imap#675)
- 🥅 Ensure send_number_data input is an Integer in ruby/net-imap#696 (backports ruby/net-imap#676)
- ♻️ Improve
RawData.new, AddRawData.splitby@nevansin ruby/net-imap#696 (backports ruby/net-imap#679)- 🥅 Validate response literal byte size format by
@nevansin ruby/net-imap#696 (backports ruby/net-imap#681)Miscellaneous
- ✅ Improvements to tests' FakeServer in ruby/net-imap#696 (backports ruby/net-imap#678)
Full Changelog: https://github.com/ruby/net-imap/compare/v0.5.14...v0.5.15
v0.5.14
What's Changed
🔒 Security
This release contains fixes for multiple vulnerabilities concerning
STARTTLSstripping, argument validation, and denial of service attacks.[!WARNING] ruby/net-imap#665 fixes a
STARTTLSstripping vulnerability (GHSA-vcgp-9326-pqcp). Without this fix, a man-in-the-middle attacker can causeNet::IMAP#starttlsto return "successfully", without starting TLS.[!IMPORTANT] Argument validation is significantly improved. Several command injection vulnerabilities have been fixed: ruby/net-imap#662 fixes CRLF/command/argument injection via Symbol arguments (GHSA-75xq-5h9v-w6px). ruby/net-imap#662 fixes CRLF/command/argument injection via the
attrargument to#store/#uid_store(GHSA-hm49-wcqc-g2xg)
... (truncated)
ce20fc8
🔖 Bump version to 0.5.150b7b83c
🔀 Merge pull request #703
from ruby/backport/v0.5/security-patchesf22fd6c
🍒 pick 0ea9eba3 (#701): ✅
Fix flaky tests for MacOS, TruffleRuby1246074
🍒 pick ae9f83b5 (#701):
♻️ Extract str.bytesize lvar in send_literala2f61af
🍒 pick 62a0da6d (#701): 🥅
Validate non-synchronizing literals supporte33348c
🍒 pick d6ddd294 (#700): 🐛
Prevent trailing {0} in RawData validation4f81b69
🍒 pick 1f97168b (#699): 🥅
Validate #enable arguments are all atoms69da4a4
🍒 pick 8d9397ab (#698): 🥅
Validate QuotedString contains only valid bytes7aab580
🍒 pick e3c50fad (#698):
♻️ Refactor RawText, add improve test coveragefac1733
🍒 pick aab64f92 (#686): 🧵
Fix deadlock in #disconnect