CVE-2026-42246

High

Advisory

Published 29 Jun 2025In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 7.6; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 35; of 17,781 indexed, latest versions
Container images: 37; deployed by those charts
Fix available: 4 of 5; affected packages

net-imap vulnerable to STARTTLS stripping via invalid response timing

Carried by container images the latest versions of 35 of 17,781 indexed charts deploy, on 37 images.

Affected package	Affected versions	Fixed in	Images
net-imapgem	0.1.1, 0.2.3, 0.2.4, 0.3.4+8 more	0.3.10, 0.4.24, 0.5.14, 0.6.4	29
ruby2.7deb	2.7.0-5ubuntu1.4, 2.7.0-5ubuntu1.5, 2.7.0-5ubuntu1.8	2.7.0-5ubuntu1.18+esm5	6
ruby2.3deb	2.3.1-2~16.04.5	2.3.1-2~ubuntu16.04.16+esm14	2
ruby3.0deb	3.0.2-7ubuntu2.4, 3.0.2-7ubuntu2.8	3.0.2-7ubuntu2.13	2
ruby3.1deb	3.1.2-7+deb12u1	no fix listed	1

OSV records: DEBIAN-CVE-2026-42246 GHSA-vcgp-9326-pqcp UBUNTU-CVE-2026-42246
Also known as: USN-8431-1, USN-8478-1

Charts affected

35 by stars

Chart

Latest

Affected images

Radar Score

zammadzammad

18.0.5

1 of 5 See more

zammad zammad 18.0.5

1 of the 5 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
ghcr.io/zammad/zammad :7.1.3-0011	e65123a43ecc	net-imap@0.5.8	0.5.14

Open the chart page →

6,887

chatwootchatwoot

2.0.24

1 of 3 See more

chatwoot chatwoot 2.0.24

1 of the 3 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
chatwoot/chatwoot :v4.15.1	67ebc751c171	net-imap@0.5.8	0.5.14

Open the chart page →

9,203

dependabot-gitlabdependabot-gitlab

6.3.0

1 of 3 See more

dependabot-gitlab dependabot-gitlab 6.3.0

1 of the 3 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
andrcuns/dependabot-gitlab :7.7.0-alpha.1	43060f159f4c	net-imap@0.6.2	0.6.4

Open the chart page →

4,556

puppetserverpuppetserver

9.5.2

1 of 5 See more

puppetserver puppetserver 9.5.2

1 of the 5 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
ghcr.io/voxpupuli/container-puppetserver :7.17.0-v1.5.0	916746209ac5	net-imap@0.1.1 ruby3.0@3.0.2-7ubuntu2.4	0.3.10 3.0.2-7ubuntu2.13

Open the chart page →

14,184

docusealzekker6

1.130.0

1 of 1 See more

docuseal zekker6 1.130.0

1 of the 1 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
docuseal/docuseal :3.2.4	a8f063f916e3	net-imap@0.6.2	0.6.4

Open the chart page →

112

manyfoldself-hosters-by-night

0.7.4

1 of 1 See more

manyfold self-hosters-by-night 0.7.4

1 of the 1 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
ghcr.io/manyfold3d/manyfold-solo :0.147.2	ed5a792b0e8d	net-imap@0.5.8	0.5.14

Open the chart page →

480

mastodondefault-gh

0.3.1

1 of 3 See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
ghcr.io/mastodon/mastodon :v4.1.2	6b18e6d0eda4	net-imap@0.3.4	0.3.10

Open the chart page →

5,056

opennebulakvaps

2.1.1

5 of 9 See more

opennebula kvaps 2.1.1

5 of the 9 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
ghcr.io/kvaps/opennebula :v5.12.0.4-1	e28e0e7de11b	ruby2.7@2.7.0-5ubuntu1.5	2.7.0-5ubuntu1.18+esm5
ghcr.io/kvaps/opennebula-exporter :v5.12.0.4	01563adc95fd	ruby2.7@2.7.0-5ubuntu1.4	2.7.0-5ubuntu1.18+esm5
ghcr.io/kvaps/opennebula-exporter :v5.12.0.4-1	2b92df1143b9	ruby2.7@2.7.0-5ubuntu1.5	2.7.0-5ubuntu1.18+esm5
ghcr.io/kvaps/opennebula-flow :v5.12.0.4-1	600221f0f43f	ruby2.7@2.7.0-5ubuntu1.5	2.7.0-5ubuntu1.18+esm5
ghcr.io/kvaps/opennebula-gate :v5.12.0.4-1	a85e03d8bc1d	ruby2.7@2.7.0-5ubuntu1.5	2.7.0-5ubuntu1.18+esm5

Open the chart page →

113,791

chatwootmaxcrm-charts

1.1.201

1 of 4 See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
chatwoot/chatwoot :v3.1.0	d530ab8c1753	net-imap@0.3.7	0.3.10

Open the chart page →

5,940

redminemt190502

7.3.4

1 of 3 See more

redmine mt190502 7.3.4

1 of the 3 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
library/redmine :6.1.2	04ac44a2595b	net-imap@0.5.8	0.5.14

Open the chart page →

7,527

opentelemetry-demoopentelemetry-helm

0.41.1

1 of 34 See more

opentelemetry-demo opentelemetry-helm 0.41.1

1 of the 34 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
ghcr.io/open-telemetry/demo :3.0.0-email	d674d4081ca4	net-imap@0.6.2	0.6.4

Open the chart page →

22,420

ansible-inspecansible-inspec

0.2.17

1 of 2 See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
ghcr.io/htunn/ansible-inspec :0.2.12	cd25a5cc3f1b	net-imap@0.2.4	0.3.10

Open the chart page →

5,558

antigenic-docuseal-helm-chartantigenic-docuseal-helm-chart

0.2.0

1 of 1 See more

antigenic-docuseal-helm-chart antigenic-docuseal-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
docuseal/docuseal :2.4.1	7493fd7f6728	net-imap@0.6.2	0.6.4

Open the chart page →

2,766

puppetservercamptocamp3

1.0.1

1 of 2 See more

puppetserver camptocamp3 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
ghcr.io/voxpupuli/puppetserver :8.7.0-main	63873f3f698e	net-imap@0.1.1 ruby3.0@3.0.2-7ubuntu2.8	0.3.10 3.0.2-7ubuntu2.13

Open the chart page →

5,886

caninecanine

0.1.10

1 of 7 See more

canine canine 0.1.10

1 of the 7 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
ghcr.io/caninehq/canine :latest	a058034ca006	net-imap@0.4.9.1	0.4.24

Open the chart page →

14,130

monitoring-stackdata354-helm

1.4.2

1 of 4 See more

monitoring-stack data354-helm 1.4.2

1 of the 4 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
grafana/fluent-plugin-loki :latest	8a3882e8c28b	net-imap@0.5.8	0.5.14

Open the chart page →

3,176

elk-stackelk-stack-test

1.0.2

1 of 9 See more

elk-stack elk-stack-test 1.0.2

1 of the 9 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
library/logstash :9.1.2	33eae14f0867	net-imap@0.5.9	0.5.14

Open the chart page →

2,942

icinga2geek-cookbook

4.2.0

1 of 1 See more

icinga2 geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
jordan/icinga2 :latest	f75025fe8ea8	net-imap@0.2.3 ruby3.1@3.1.2-7+deb12u1	0.3.10 no fix listed

Open the chart page →

9,077

opentelemetry-demogpg-dev

0.33.8

1 of 27 See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
ghcr.io/open-telemetry/demo :1.12.0-emailservice	a1f5cebb5240	net-imap@0.3.6	0.3.10

Open the chart page →

49,025

docker-registry-browsergtaylor

0.4.4

1 of 1 See more

docker-registry-browser gtaylor 0.4.4

1 of the 1 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
klausmeyer/docker-registry-browser :1.4.0	bdc4c6b8595b	net-imap@0.1.1	0.3.10

Open the chart page →

3,564

octoboxhalkeye

0.1.1

1 of 1 See more

octobox halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
octoboxio/octobox :latest	d909041c46eb	net-imap@0.6.2	0.6.4

Open the chart page →

3,255

manyfoldjeffresc

1.0.3

1 of 1 See more

manyfold jeffresc 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
ghcr.io/manyfold3d/manyfold :0.136.0	d14ca4d82475	net-imap@0.6.3	0.6.4

Open the chart page →

1,960

deltabadgerk8s-charts

2.0.0

1 of 1 See more

deltabadger k8s-charts 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
ghcr.io/deltabadger/deltabadger :2.23.3	bffe3c22fabc	net-imap@0.5.8	0.5.14

Open the chart page →

5,669

fluentd-elasticsearchkfirfer

13.9.1

1 of 1 See more

fluentd-elasticsearch kfirfer 13.9.1

1 of the 1 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
quay.io/fluentd_elasticsearch/fluentd :v4.2.3	99079df58561	net-imap@0.2.3	0.3.10

Open the chart page →

1,178

lm-logslogicmonitor

0.3.5

1 of 1 See more

lm-logs logicmonitor 0.3.5

1 of the 1 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
logicmonitor/lm-logs-k8s-fluentd :1.0.5	5ac21b3f1572	net-imap@0.2.3	0.3.10

Open the chart page →

1,029

maxcrm-chartsmaxcrm-charts

1.1.201

1 of 4 See more

maxcrm-charts maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
chatwoot/chatwoot :v3.1.0	d530ab8c1753	net-imap@0.3.7	0.3.10

Open the chart page →

5,940

danboorumy0n

0.0.2

1 of 1 See more

danbooru my0n 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
ghcr.io/danbooru/danbooru :9cab67c0ac72a8c52289302c519715ceec2372d9	5f545698e907	net-imap@0.2.3	0.3.10

Open the chart page →

12,791

danbooru-stackmy0n

0.0.3

1 of 4 See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
ghcr.io/danbooru/danbooru :9cab67c0ac72a8c52289302c519715ceec2372d9	5f545698e907	net-imap@0.2.3	0.3.10

Open the chart page →

12,791

comacopencord

1.0.0

1 of 9 See more

comac opencord 1.0.0

1 of the 9 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
omecproject/onos-progran :1.0.0	5715e5648aa0	ruby2.3@2.3.1-2~16.04.5	2.3.1-2~ubuntu16.04.16+esm14

Open the chart page →

88,546

onos-progranopencord

1.2.7

1 of 2 See more

onos-progran opencord 1.2.7

1 of the 2 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
muluder/prograncontrollermcord :0.1.8	43b597a93da7	ruby2.3@2.3.1-2~16.04.5	2.3.1-2~ubuntu16.04.16+esm14

Open the chart page →

38,865

mastodonrivals-space

3.1.2

1 of 3 See more

mastodon rivals-space 3.1.2

1 of the 3 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
ghcr.io/rivals-space/rivals-mastodon :1.6.1	43b23d55e4be	net-imap@0.1.1	0.3.10

Open the chart page →

6,026

fluentdsinextra

1.4.5

1 of 1 See more

fluentd sinextra 1.4.5

1 of the 1 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
ghcr.io/sergelogvinov/fluentd :1.19.3	3273d13f1e75	net-imap@0.5.8	0.5.14

Open the chart page →

1,085

fluentd-operatorstatcan

0.5.1

1 of 1 See more

fluentd-operator statcan 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
vmware/kube-fluentd-operator :latest	f028c138a5f4	net-imap@0.3.7	0.3.10

Open the chart page →

1,955

maybe-financevicsufer

0.2.7

1 of 3 See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
ghcr.io/maybe-finance/maybe :0.5.0	c6ab95ca9130	net-imap@0.5.4	0.5.14

Open the chart page →

10,795

kongwallarm

4.6.3

1 of 7 See more

kong wallarm 4.6.3

1 of the 7 container images this version deploys carry CVE-2026-42246.

Container image	Digest	Package	Fixed in
wallarm/kong :3.1.0-ubuntu-4.6.0	ea9608c82e40	ruby2.7@2.7.0-5ubuntu1.8	2.7.0-5ubuntu1.18+esm5

Open the chart page →

11,405

Container images carrying it

37 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
chatwoot/chatwoot :v3.1.0	d530ab8c1753	net-imap@0.3.7	0.3.10	2
ghcr.io/danbooru/danbooru :9cab67c0ac72a8c52289302c519715ceec2372d9	5f545698e907	net-imap@0.2.3	0.3.10	2
andrcuns/dependabot-gitlab :7.7.0-alpha.1	43060f159f4c	net-imap@0.6.2	0.6.4	1
chatwoot/chatwoot :v4.15.1	67ebc751c171	net-imap@0.5.8	0.5.14	1
docuseal/docuseal :2.4.1	7493fd7f6728	net-imap@0.6.2	0.6.4	1
docuseal/docuseal :3.2.4	a8f063f916e3	net-imap@0.6.2	0.6.4	1
grafana/fluent-plugin-loki :latest	8a3882e8c28b	net-imap@0.5.8	0.5.14	1
jordan/icinga2 :latest	f75025fe8ea8	net-imap@0.2.3 ruby3.1@3.1.2-7+deb12u1	0.3.10 no fix listed	1
klausmeyer/docker-registry-browser :1.4.0	bdc4c6b8595b	net-imap@0.1.1	0.3.10	1
library/logstash :9.1.2	33eae14f0867	net-imap@0.5.9	0.5.14	1
library/redmine :6.1.2	04ac44a2595b	net-imap@0.5.8	0.5.14	1
logicmonitor/lm-logs-k8s-fluentd :1.0.5	5ac21b3f1572	net-imap@0.2.3	0.3.10	1
muluder/prograncontrollermcord :0.1.8	43b597a93da7	ruby2.3@2.3.1-2~16.04.5	2.3.1-2~ubuntu16.04.16+esm14	1
octoboxio/octobox :latest	d909041c46eb	net-imap@0.6.2	0.6.4	1
omecproject/onos-progran :1.0.0	5715e5648aa0	ruby2.3@2.3.1-2~16.04.5	2.3.1-2~ubuntu16.04.16+esm14	1
vmware/kube-fluentd-operator :latest	f028c138a5f4	net-imap@0.3.7	0.3.10	1
wallarm/kong :3.1.0-ubuntu-4.6.0	ea9608c82e40	ruby2.7@2.7.0-5ubuntu1.8	2.7.0-5ubuntu1.18+esm5	1
ghcr.io/caninehq/canine :latest	a058034ca006	net-imap@0.4.9.1	0.4.24	1
ghcr.io/deltabadger/deltabadger :2.23.3	bffe3c22fabc	net-imap@0.5.8	0.5.14	1
ghcr.io/htunn/ansible-inspec :0.2.12	cd25a5cc3f1b	net-imap@0.2.4	0.3.10	1
ghcr.io/kvaps/opennebula :v5.12.0.4-1	e28e0e7de11b	ruby2.7@2.7.0-5ubuntu1.5	2.7.0-5ubuntu1.18+esm5	1
ghcr.io/kvaps/opennebula-exporter :v5.12.0.4	01563adc95fd	ruby2.7@2.7.0-5ubuntu1.4	2.7.0-5ubuntu1.18+esm5	1
ghcr.io/kvaps/opennebula-exporter :v5.12.0.4-1	2b92df1143b9	ruby2.7@2.7.0-5ubuntu1.5	2.7.0-5ubuntu1.18+esm5	1
ghcr.io/kvaps/opennebula-flow :v5.12.0.4-1	600221f0f43f	ruby2.7@2.7.0-5ubuntu1.5	2.7.0-5ubuntu1.18+esm5	1
ghcr.io/kvaps/opennebula-gate :v5.12.0.4-1	a85e03d8bc1d	ruby2.7@2.7.0-5ubuntu1.5	2.7.0-5ubuntu1.18+esm5	1
ghcr.io/manyfold3d/manyfold :0.136.0	d14ca4d82475	net-imap@0.6.3	0.6.4	1
ghcr.io/manyfold3d/manyfold-solo :0.147.2	ed5a792b0e8d	net-imap@0.5.8	0.5.14	1
ghcr.io/mastodon/mastodon :v4.1.2	6b18e6d0eda4	net-imap@0.3.4	0.3.10	1
ghcr.io/maybe-finance/maybe :0.5.0	c6ab95ca9130	net-imap@0.5.4	0.5.14	1
ghcr.io/open-telemetry/demo :1.12.0-emailservice	a1f5cebb5240	net-imap@0.3.6	0.3.10	1
ghcr.io/open-telemetry/demo :3.0.0-email	d674d4081ca4	net-imap@0.6.2	0.6.4	1
ghcr.io/rivals-space/rivals-mastodon :1.6.1	43b23d55e4be	net-imap@0.1.1	0.3.10	1
ghcr.io/sergelogvinov/fluentd :1.19.3	3273d13f1e75	net-imap@0.5.8	0.5.14	1
ghcr.io/voxpupuli/container-puppetserver :7.17.0-v1.5.0	916746209ac5	net-imap@0.1.1 ruby3.0@3.0.2-7ubuntu2.4	0.3.10 3.0.2-7ubuntu2.13	1
ghcr.io/voxpupuli/puppetserver :8.7.0-main	63873f3f698e	net-imap@0.1.1 ruby3.0@3.0.2-7ubuntu2.8	0.3.10 3.0.2-7ubuntu2.13	1
ghcr.io/zammad/zammad :7.1.3-0011	e65123a43ecc	net-imap@0.5.8	0.5.14	1
quay.io/fluentd_elasticsearch/fluentd :v4.2.3	99079df58561	net-imap@0.2.3	0.3.10	1