HCE2-SA-2026-0246 Critical HCE 2.0 Security Fix(es): Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4. (CVE-2026-42257) Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4. (CVE-2026-42258) Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4. (CVE-2026-42246) Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client_x27;s CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4. (CVE-2026-42245) ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `_` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue. (CVE-2026-41316) HCE 2.0 rubygems-3.2.32-122.r20.hce2.noarch.rpm rubygems-devel-3.2.32-122.r20.hce2.noarch.rpm rubygem-bigdecimal-3.0.0-122.r20.hce2.x86_64.rpm rubygem-did_you_mean-1.5.0-122.r20.hce2.noarch.rpm rubygem-io-console-0.5.7-122.r20.hce2.x86_64.rpm rubygem-json-2.5.1-122.r20.hce2.x86_64.rpm rubygem-minitest-5.14.2-122.r20.hce2.noarch.rpm rubygem-openssl-2.2.1-122.r20.hce2.x86_64.rpm rubygem-power_assert-1.2.0-122.r20.hce2.noarch.rpm rubygem-psych-3.3.2-122.r20.hce2.x86_64.rpm rubygem-rake-13.0.3-122.r20.hce2.noarch.rpm rubygem-rbs-1.4.0-122.r20.hce2.noarch.rpm rubygem-rdoc-6.3.3-122.r20.hce2.noarch.rpm rubygem-rexml-3.2.5-122.r20.hce2.noarch.rpm rubygem-rss-0.2.9-122.r20.hce2.noarch.rpm rubygem-test-unit-3.3.7-122.r20.hce2.noarch.rpm rubygem-typeprof-0.15.2-122.r20.hce2.noarch.rpm ruby-3.0.3-122.r20.hce2.x86_64.rpm ruby-devel-3.0.3-122.r20.hce2.x86_64.rpm ruby-help-3.0.3-122.r20.hce2.noarch.rpm ruby-irb-3.0.3-122.r20.hce2.noarch.rpm rubygem-bigdecimal-3.0.0-122.r20.hce2.aarch64.rpm rubygem-io-console-0.5.7-122.r20.hce2.aarch64.rpm rubygem-json-2.5.1-122.r20.hce2.aarch64.rpm rubygem-openssl-2.2.1-122.r20.hce2.aarch64.rpm rubygem-psych-3.3.2-122.r20.hce2.aarch64.rpm ruby-3.0.3-122.r20.hce2.aarch64.rpm ruby-devel-3.0.3-122.r20.hce2.aarch64.rpm