Ubuntu Ruby Critical Network Access Issues USN-8478-1 CVE-2026-42246

ubuntu

June 30, 2026

Ruby could allow unintended access to network services.

Summary

Ruby could allow unintended access to network services.

Software Description:

- ruby3.3: Object-oriented scripting language

- ruby3.2: Object-oriented scripting language

- ruby3.0: Object-oriented scripting language

- ruby2.7: Object-oriented scripting language

Details:

It was discovered that Ruby's Net::IMAP library did not properly verify

that TLS encryption was started after issuing a STARTTLS command. A remote

attacker could use this to perform a machine-in-the-middle attack and silently

bypass TLS encryption. (CVE-2026-42246)

It was discovered that Ruby's Net::IMAP library did not validate

string arguments passed to certain commands. A remote attacker could use

this to inject arbitrary IMAP commands. (CVE-2026-42257)

It was discovered that Ruby's Net::IMAP library was vulnerable to a

denial of service attack when authenticating with SCRAM-SHA1 or

SCRAM-SHA256. A hostile server could send a very large iteration count

value to cause excessive computation in the client. This...

Read the Full Advisory

Topics Covered

security advisory denial of service remote attack Ubuntu ruby network access

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  libruby3.3                      3.3.8-2ubuntu3.1
  ruby3.3                         3.3.8-2ubuntu3.1

Ubuntu 24.04 LTS
  libruby3.2                      3.2.3-1ubuntu0.24.04.8
  ruby3.2                         3.2.3-1ubuntu0.24.04.8

Ubuntu 22.04 LTS
  libruby3.0                      3.0.2-7ubuntu2.13
  ruby3.0                         3.0.2-7ubuntu2.13

Ubuntu 20.04 LTS
  libruby2.7                      2.7.0-5ubuntu1.18+esm5
                                  Available with Ubuntu Pro
  ruby2.7                         2.7.0-5ubuntu1.18+esm5
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.